How do I scan GitHub for leaked secrets and subdomains?

Turn on GitHub scanning with -g and supply a personal access token with -gt. SubDomainizer then searches public repositories tied to the target for subdomains and for strings that match API keys and tokens, a frequent source of credential leaks.

Do I need a GitHub token?

Only for the -g scan. The token authenticates SubDomainizer against the GitHub search API. Page fetching and JavaScript parsing run without one, so you can skip -g and -gt if you only care about a live site.

How is SubDomainizer different from SecretFinder?

SecretFinder runs a set of regexes over JavaScript files to flag secrets. SubDomainizer covers that same secret detection and also recovers subdomains and cloud-service URLs from the page, and it can extend the search to GitHub in one pass.

Where do cloud-service URLs go?

Pass -cop with a filename to write S3 buckets and other cloud-service URLs to their own file. That gives you a clean list to feed a cloud-enumeration step instead of grepping it out of the main results.

Does SubDomainizer touch the target?

Yes. It fetches the URL and the scripts that page references, so run it against live URLs rather than a raw domain. Wire a crawler such as katana in front of it. Use -c to send session cookies for pages behind auth, and -k to skip SSL certificate verification.

Can I run it on many URLs at once?

Pass -l with a file that holds one URL per line. This pairs well with a crawler that emits every JavaScript-bearing URL for a target, so a single node covers the whole surface a crawl uncovered.

Updated Jul 14, 2026

Recon

Extract hidden subdomains and secrets from a page's JavaScript

Find hidden subdomains and secrets in webpages, external JavaScript, and GitHub.

Extract subdomains from JavaScript Surface leaked secrets in bundled scripts Scan GitHub for the same target

overview

What subdomainizer does

SubDomainizer digs subdomains and secrets out of the content a page loads. It fetches a URL, parses the inline and external JavaScript it references, and extracts hostnames, cloud-service URLs, and patterns that look like API keys or tokens. The names buried in bundled scripts often point to internal services no passive source lists.

It reaches past the page itself. With GitHub scanning enabled and a token, it searches public repositories for the same target, surfacing subdomains and secrets that leaked into committed code. Cloud-service results can be written to their own file for follow-up.

On Trickest, SubDomainizer is a Recon node that takes a URL and writes a file and a folder of findings. Run it after a crawler that collects JavaScript URLs, then feed the subdomains it recovers into a prober and the secrets into your triage flow.

source github.com/nsonaniya2010/SubDomainizer

use cases

Where subdomainizer fits

Extract subdomains from JavaScript

Parse a page's inline and external scripts to recover hostnames that point to internal services passive enumeration never sees.

Surface leaked secrets in bundled scripts

Flag strings that match API keys and tokens in the loaded JavaScript so exposed credentials get caught before an attacker finds them.

Scan GitHub for the same target

Enable GitHub scanning with a token to find subdomains and secrets that leaked into public repositories, a common source of credential exposure.

Collect cloud-service references

Write discovered cloud-service URLs, such as S3 buckets, to their own file to drive cloud-enumeration follow-up.

reference

subdomainizer inputs and flags

9 inputs

Name	Type	Flag	Description
url	STRING	-u	URL in which to find (sub)domains.
url-list-file	FILE	-l	File containing a list of URLs to scan.
domain	STRING	-d	Top-level domain to scope subdomain discovery to (e.g. example.com).
github-scan	BOOLEAN	-g	Also search GitHub for subdomains and secrets.
github-api-token	STRING	-gt	GitHub API token, required when GitHub scanning is enabled.
cookie	STRING	-c	Cookies to send with the request.
bypass-ssl	BOOLEAN	-k	Bypass verification of the SSL certificate.
cloud-services-results	FILE	-cop	File name in which to store cloud-services results.

Showing key inputs. subdomainizer exposes 9 inputs in total.

Full flag reference (9 inputs)

Name	Type	Flag	Description
url	STRING	-u	URL in which to find (sub)domains.
cookie	STRING	-c	Cookies to send with the request.
domain	STRING	-d	Top-level domain to scope discovery to (e.g. example.com for www.example.com).
bypass-ssl	BOOLEAN	-k	Bypass verification of the SSL certificate.
github-scan	BOOLEAN	-g	Also search GitHub for subdomains and secrets.
root-folder	STRING	-f	Root folder that contains the files or folders to scan.
url-list-file	FILE	-l	File containing a list of URLs to scan.
github-api-token	STRING	-gt	GitHub API token, required with -g to scan GitHub.
cloud-services-results	FILE	-cop	File name in which to store cloud-services results.

example

Run subdomainizer

subdomainizer · command

# mine a page's JavaScript for subdomains and secrets, and scan GitHub toopython3 SubDomainizer.py -u https://example.com -d example.com -g -gt <github-token> -o subs.txt -cop cloud-services.txt

sample output

[+] Total 5 unique subdomains found:api.example.comassets.example.cominternal-staging.example.commetrics.example.comvpn.example.com[+] Cloud services found:https://example-static.s3.amazonaws.com[+] Possible secrets found:aws_access_key : AKIAIOSFODNN7EXAMPLE  (in https://example.com/static/app.min.js)

guidance

Choosing subdomainizer

Use SubDomainizer when you want subdomains and secrets that live in a page's JavaScript, not just in DNS data. It reads content, so point it at live URLs from a crawler. For pure passive name enumeration, subfinder is faster; run SubDomainizer to catch what scripts and GitHub leak.

subfinder

Passive subdomain enumeration from datasets. SubDomainizer mines JavaScript and GitHub for names and secrets datasets miss.

LinkFinder

Mines JavaScript for endpoints and links. SubDomainizer pulls subdomains, cloud URLs, and secrets from the same scripts and from GitHub.

faq

subdomainizer questions

Point -u at the page, or pass -l with a file of URLs. SubDomainizer fetches each one, parses its inline and external scripts, and pulls out hostnames. Scope the results to a top-level domain with -d so you keep only the target's names.

Run subdomainizer yourself

A URL is crawled by katana for JavaScript, then SubDomainizer mines those scripts for subdomains and secrets written as output.

Run subdomainizer in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

-u

URL in which to find (sub)domains.

url-list-file

FILE

-l

File containing a list of URLs to scan.

domain

STRING

-d

Top-level domain to scope subdomain discovery to (e.g. example.com).

github-scan

BOOLEAN

-g

Also search GitHub for subdomains and secrets.

github-api-token

STRING

-gt

GitHub API token, required when GitHub scanning is enabled.

STRING

-c

Cookies to send with the request.

bypass-ssl

BOOLEAN

-k

Bypass verification of the SSL certificate.

cloud-services-results

FILE

-cop

File name in which to store cloud-services results.

Name

Type

Flag

Description

url

STRING

-u

URL in which to find (sub)domains.

STRING

-c

Cookies to send with the request.

domain

STRING

-d

Top-level domain to scope discovery to (e.g. example.com for www.example.com).

bypass-ssl

BOOLEAN

-k

Bypass verification of the SSL certificate.

github-scan

BOOLEAN

-g

Also search GitHub for subdomains and secrets.

root-folder

STRING

-f

Root folder that contains the files or folders to scan.

url-list-file

FILE

-l

File containing a list of URLs to scan.

github-api-token

STRING

-gt

GitHub API token, required with -g to scan GitHub.

cloud-services-results

FILE

-cop

File name in which to store cloud-services results.

[+] Total 5 unique subdomains found:api.example.comassets.example.cominternal-staging.example.commetrics.example.comvpn.example.com[+] Cloud services found:https://example-static.s3.amazonaws.com[+] Possible secrets found:aws_access_key : AKIAIOSFODNN7EXAMPLE (in https://example.com/static/app.min.js)

Extract hidden subdomains and secrets from a page's JavaScript

What subdomainizer does

Where subdomainizer fits

Extract subdomains from JavaScript

Surface leaked secrets in bundled scripts

Scan GitHub for the same target

Collect cloud-service references

subdomainizer inputs and flags

Run subdomainizer

Choosing subdomainizer

subfinder

LinkFinder

subdomainizer questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run subdomainizer yourself

Extract hidden subdomains and secrets from a page's JavaScript

What subdomainizer does

Where subdomainizer fits

Extract subdomains from JavaScript

Surface leaked secrets in bundled scripts

Scan GitHub for the same target

Collect cloud-service references

subdomainizer inputs and flags

Run subdomainizer

Choosing subdomainizer

subfinder

LinkFinder

subdomainizer questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run subdomainizer yourself