Recon
Crawl pages for second-order subdomain takeover refs
Crawler that collects second-order subdomain references for takeover review.
overview
What second-order does
second-order crawls a -target URL and records the resources each page loads. It hunts second-order subdomain takeover: a trusted page still pulls a script, image, or link from a subdomain that no longer resolves.
A -config file selects which attributes and resources to collect. -depth bounds how far the crawl walks, -header carries session context, and -threads sets concurrency. Output is a folder of structured results, not a single verdict.
DNS and certificate host lists miss references that live only in page HTML. Crawl discovered hosts with second-order, then confirm dangling candidates with subjack or nuclei takeover templates.
use cases
Where second-order fits
Find dangling subdomain references
Crawl a target and collect the subdomain resources its pages load, surfacing references that point at services no longer claimed and open to takeover.
Drive collection with a config file
Use the -config file to specify which HTML attributes and resources to record, whether to log non-200 references, and which URLs to skip, so the crawl captures exactly what you want to review.
Bound the crawl depth
Set -depth to control how far second-order walks from the seed, keeping a scan focused on the immediate surface or reaching deeper into linked pages.
Crawl authenticated areas
Pass -header to carry a session cookie or token so pages behind a login are crawled and the resources they load are inspected for dangling references.
reference
second-order inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | -target | Target URL to crawl. |
| config | FILE | -config | Configuration file controlling which attributes and resources to collect. |
| depth | STRING | -depth | How far to crawl from the seed URL. Default: 1. |
| header | STRING | -header | Header as 'Name: Value', usable more than once for session context. |
| threads | STRING | -threads | Number of concurrent crawl threads. Default: 10. |
| insecure | BOOLEAN | -insecure | Accept untrusted SSL/TLS certificates while crawling. |
Showing key inputs. second-order exposes 6 inputs in total.
example
Run second-order
# crawl a target two levels deep, collecting the configured resourcessecond-order -target https://example.com -config config.json -depth 2 -threads 20# output/ folder: one JSON file per configured attributeoutput/script-src.json (loaded <script src> values)output/a-href.json (page <a href> links)# script-src.json excerpt: pages mapped to the scripts they load{ "https://example.com/": [ "https://cdn.example.com/app.js", "https://assets.staging.example.com/widget.js" ]}guidance
Choosing second-order
Use second-order when you need takeover risk through resources a trusted page loads, not only host enumeration. For direct checks against a subdomain list, subjack or nuclei takeover templates are a faster fit.
subjack
Checks a subdomain list against known takeover fingerprints directly.
nuclei
Runs takeover-detection templates across a host list as part of broader scanning.
katana
General-purpose crawler when you want endpoints rather than takeover candidates.
faq
second-order questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run second-order yourself
A target URL feeds second-order, which crawls the site and records loaded subdomain references, writing takeover candidates as a queryable output.
Facts on this page come from the live Trickest tool library.