loading
Loading content
loading
Recon
Find subdomains for a domain in public GitHub code.
overview
github-subdomains searches public GitHub for hostnames that reference your target domains. Config, CI, Terraform, and scripts often name staging hosts, internal APIs, and retired services missing from DNS feeds and certificate logs.
Every search hits the GitHub code-search API, so pass tokens with -t. -q skips extra per-language and noise queries. -e also searches dummy-prefixed domain variants. -k exits once every token is rate-limited. Domains input is a file, one domain per line.
Trickest runs it as a managed Recon node beside other passive sources. Merge names with subfinder or amass, then resolve and probe with httpx before scanning.
use cases
Search public GitHub for a target domain and recover staging hosts, internal APIs, and forgotten services that passive DNS sources and certificate logs never list.
Run github-subdomains beside subfinder and amass, then merge the results so the workflow resolves and probes every name from all three sources, not one.
Feed a comma-separated token list or a token file so the tool spreads requests across keys, keeps searching past a single token's rate limit, and exits cleanly with -k once they are all spent.
Pass the file of found subdomains to a resolver and httpx so only live hosts continue to your scanners downstream.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | Domains you are looking for, one per line (required). |
| tokens | STRING | -t | GitHub API tokens separated by commas. |
| tokens-file | FILE | -t | A file containing one GitHub token per line. |
| quick | BOOLEAN | -q | Quick mode; skip the extra per-language and noise searches. |
| extended-mode | BOOLEAN | -e | Extended mode; also search for dummy-prefixed variants of the domain. |
| exit-when-tokens-get-limited | BOOLEAN | -k | Exit the program once all tokens have been disabled. |
| raw | BOOLEAN | -raw | Raw output. |
Showing key inputs. github-subdomains exposes 7 inputs in total.
example
# mine public GitHub for a domain's subdomains, two tokens, extended modegithub-subdomains -d example.com -t ghp_TOKEN1,ghp_TOKEN2 -e -o subdomains.txtapi.example.comdev.example.comstaging.example.cominternal-api.example.comjenkins.example.comgrafana.staging.example.comvpn.example.comgitlab-runner.dev.example.coms3-assets.example.comguidance
Use github-subdomains to add a source-code source to subdomain discovery. It needs GitHub API tokens via -t. Run it alongside subfinder and amass for passive coverage, then hand the merged names to a resolver and httpx. Prefer github-endpoints when you want paths, not hosts.
Passive discovery from certificate logs and DNS aggregators. Different source for the same subdomain goal.
Same author and token model. Harvests endpoints instead of subdomains from public GitHub.
Broad multi-source enumeration. Heavier to run; wider coverage than a single GitHub source.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain list feeds github-subdomains, which mines public GitHub for hostnames and passes them to httpx so only live subdomains land as output.
Facts on this page come from the live Trickest tool library.