Recon
Recover subdomains named in public GitHub code
Find subdomains for a domain in public GitHub code.
overview
What github-subdomains does
github-subdomains searches public GitHub for hostnames that reference your target domains. Config, CI, Terraform, and scripts often name staging hosts, internal APIs, and retired services missing from DNS feeds and certificate logs.
Every search hits the GitHub code-search API, so pass tokens with -t. -q skips extra per-language and noise queries. -e also searches dummy-prefixed domain variants. -k exits once every token is rate-limited. Domains input is a file, one domain per line.
Trickest runs it as a managed Recon node beside other passive sources. Merge names with subfinder or amass, then resolve and probe with httpx before scanning.
use cases
Where github-subdomains fits
Surface subdomains that only live in code
Search public GitHub for a target domain and recover staging hosts, internal APIs, and forgotten services that passive DNS sources and certificate logs never list.
Add a source-code source to passive recon
Run github-subdomains beside subfinder and amass, then merge the results so the workflow resolves and probes every name from all three sources, not one.
Rotate tokens through a large search
Feed a comma-separated token list or a token file so the tool spreads requests across keys, keeps searching past a single token's rate limit, and exits cleanly with -k once they are all spent.
Feed discovered hosts into a probing pipeline
Pass the file of found subdomains to a resolver and httpx so only live hosts continue to your scanners downstream.
reference
github-subdomains inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | Domains you are looking for, one per line (required). |
| tokens | STRING | -t | GitHub API tokens separated by commas. |
| tokens-file | FILE | -t | A file containing one GitHub token per line. |
| quick | BOOLEAN | -q | Quick mode; skip the extra per-language and noise searches. |
| extended-mode | BOOLEAN | -e | Extended mode; also search for dummy-prefixed variants of the domain. |
| exit-when-tokens-get-limited | BOOLEAN | -k | Exit the program once all tokens have been disabled. |
| raw | BOOLEAN | -raw | Raw output. |
Showing key inputs. github-subdomains exposes 7 inputs in total.
example
Run github-subdomains
# mine public GitHub for a domain's subdomains, two tokens, extended modegithub-subdomains -d example.com -t ghp_TOKEN1,ghp_TOKEN2 -e -o subdomains.txtapi.example.comdev.example.comstaging.example.cominternal-api.example.comjenkins.example.comgrafana.staging.example.comvpn.example.comgitlab-runner.dev.example.coms3-assets.example.comguidance
Choosing github-subdomains
Use github-subdomains to add a source-code source to subdomain discovery. It needs GitHub API tokens via -t. Run it alongside subfinder and amass for passive coverage, then hand the merged names to a resolver and httpx. Prefer github-endpoints when you want paths, not hosts.
subfinder
Passive discovery from certificate logs and DNS aggregators. Different source for the same subdomain goal.
github-endpoints
Same author and token model. Harvests endpoints instead of subdomains from public GitHub.
amass
Broad multi-source enumeration. Heavier to run; wider coverage than a single GitHub source.
faq
github-subdomains questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run github-subdomains yourself
A domain list feeds github-subdomains, which mines public GitHub for hostnames and passes them to httpx so only live subdomains land as output.
Facts on this page come from the live Trickest tool library.