Recon
Pull subdomains and secrets from page JavaScript
Mine JavaScript and GitHub for subdomains, cloud URLs, and secrets.
overview
What subdomainizer does
SubDomainizer fetches a URL with -u, parses inline and external JavaScript, and extracts hostnames, cloud-service URLs, and strings that look like API keys or tokens. Names buried in bundled scripts often point to internal services no passive DNS source lists.
Scope results to a top-level domain with -d. Pass -l for a URL list from a crawler. Enable -g with -gt to search public GitHub for the same target. Write cloud-service URLs to their own file with -cop for a separate enumeration step.
Run it after a crawler that collected JavaScript-bearing pages, then feed recovered hosts to a prober and secrets into triage. Prefer subfinder for pure passive name lists; use SubDomainizer when the signal lives in page content or committed code. Trickest runs it as a managed Recon node.
use cases
Where subdomainizer fits
Extract subdomains from JavaScript
Parse a page's inline and external scripts to recover hostnames that point to internal services passive enumeration never sees.
Surface leaked secrets in bundled scripts
Flag strings that match API keys and tokens in the loaded JavaScript so exposed credentials get caught before an attacker finds them.
Scan GitHub for the same target
Enable GitHub scanning with a token to find subdomains and secrets that leaked into public repositories, a common source of credential exposure.
Collect cloud-service references
Write discovered cloud-service URLs, such as S3 buckets, to their own file to drive cloud-enumeration follow-up.
reference
subdomainizer inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | URL in which to find (sub)domains. |
| url-list-file | FILE | -l | File containing a list of URLs to scan. |
| domain | STRING | -d | Top-level domain to scope subdomain discovery to (e.g. example.com). |
| github-scan | BOOLEAN | -g | Also search GitHub for subdomains and secrets. |
| github-api-token | STRING | -gt | GitHub API token, required when GitHub scanning is enabled. |
| cookie | STRING | -c | Cookies to send with the request. |
| bypass-ssl | BOOLEAN | -k | Bypass verification of the SSL certificate. |
| cloud-services-results | FILE | -cop | File name in which to store cloud-services results. |
Showing key inputs. subdomainizer exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | URL in which to find (sub)domains. |
| cookie | STRING | -c | Cookies to send with the request. |
| domain | STRING | -d | Top-level domain to scope discovery to (e.g. example.com for www.example.com). |
| bypass-ssl | BOOLEAN | -k | Bypass verification of the SSL certificate. |
| github-scan | BOOLEAN | -g | Also search GitHub for subdomains and secrets. |
| root-folder | STRING | -f | Root folder that contains the files or folders to scan. |
| url-list-file | FILE | -l | File containing a list of URLs to scan. |
| github-api-token | STRING | -gt | GitHub API token, required with -g to scan GitHub. |
| cloud-services-results | FILE | -cop | File name in which to store cloud-services results. |
example
Run subdomainizer
# mine a page's JavaScript for subdomains and secrets, and scan GitHub toopython3 SubDomainizer.py -u https://example.com -d example.com -g -gt <github-token> -o subs.txt -cop cloud-services.txt[+] Total 5 unique subdomains found:api.example.comassets.example.cominternal-staging.example.commetrics.example.comvpn.example.com[+] Cloud services found:https://example-static.s3.amazonaws.com[+] Possible secrets found:aws_access_key : AKIAIOSFODNN7EXAMPLE (in https://example.com/static/app.min.js)guidance
Choosing subdomainizer
Use SubDomainizer when subdomains or secrets live in a page's JavaScript or in public GitHub, not only in DNS datasets. Point it at live URLs from a crawler. For passive name enumeration alone, subfinder is the lighter first pass.
subfinder
Passive subdomain enumeration from datasets. SubDomainizer mines JavaScript and GitHub for names and secrets those sources miss.
LinkFinder
Mines JavaScript for endpoints and links. SubDomainizer pulls subdomains, cloud URLs, and secrets from scripts and from GitHub.
faq
subdomainizer questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run subdomainizer yourself
A URL is crawled by katana for JavaScript, then SubDomainizer mines those scripts for subdomains and secrets written as output.
Facts on this page come from the live Trickest tool library.