loading
Loading content
loading
Recon
Mine JavaScript and GitHub for subdomains, cloud URLs, and secrets.
overview
SubDomainizer fetches a URL with -u, parses inline and external JavaScript, and extracts hostnames, cloud-service URLs, and strings that look like API keys or tokens. Names buried in bundled scripts often point to internal services no passive DNS source lists.
Scope results to a top-level domain with -d. Pass -l for a URL list from a crawler. Enable -g with -gt to search public GitHub for the same target. Write cloud-service URLs to their own file with -cop for a separate enumeration step.
Run it after a crawler that collected JavaScript-bearing pages, then feed recovered hosts to a prober and secrets into triage. Prefer subfinder for pure passive name lists; use SubDomainizer when the signal lives in page content or committed code. Trickest runs it as a managed Recon node.
use cases
Parse a page's inline and external scripts to recover hostnames that point to internal services passive enumeration never sees.
Flag strings that match API keys and tokens in the loaded JavaScript so exposed credentials get caught before an attacker finds them.
Enable GitHub scanning with a token to find subdomains and secrets that leaked into public repositories, a common source of credential exposure.
Write discovered cloud-service URLs, such as S3 buckets, to their own file to drive cloud-enumeration follow-up.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | URL in which to find (sub)domains. |
| url-list-file | FILE | -l | File containing a list of URLs to scan. |
| domain | STRING | -d | Top-level domain to scope subdomain discovery to (e.g. example.com). |
| github-scan | BOOLEAN | -g | Also search GitHub for subdomains and secrets. |
| github-api-token | STRING | -gt | GitHub API token, required when GitHub scanning is enabled. |
| cookie | STRING | -c | Cookies to send with the request. |
| bypass-ssl | BOOLEAN | -k | Bypass verification of the SSL certificate. |
| cloud-services-results | FILE | -cop | File name in which to store cloud-services results. |
Showing key inputs. subdomainizer exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | URL in which to find (sub)domains. |
| cookie | STRING | -c | Cookies to send with the request. |
| domain | STRING | -d | Top-level domain to scope discovery to (e.g. example.com for www.example.com). |
| bypass-ssl | BOOLEAN | -k | Bypass verification of the SSL certificate. |
| github-scan | BOOLEAN | -g | Also search GitHub for subdomains and secrets. |
| root-folder | STRING | -f | Root folder that contains the files or folders to scan. |
| url-list-file | FILE | -l | File containing a list of URLs to scan. |
| github-api-token | STRING | -gt | GitHub API token, required with -g to scan GitHub. |
| cloud-services-results | FILE | -cop | File name in which to store cloud-services results. |
example
# mine a page's JavaScript for subdomains and secrets, and scan GitHub toopython3 SubDomainizer.py -u https://example.com -d example.com -g -gt <github-token> -o subs.txt -cop cloud-services.txt[+] Total 5 unique subdomains found:api.example.comassets.example.cominternal-staging.example.commetrics.example.comvpn.example.com[+] Cloud services found:https://example-static.s3.amazonaws.com[+] Possible secrets found:aws_access_key : AKIAIOSFODNN7EXAMPLE (in https://example.com/static/app.min.js)guidance
Use SubDomainizer when subdomains or secrets live in a page's JavaScript or in public GitHub, not only in DNS datasets. Point it at live URLs from a crawler. For passive name enumeration alone, subfinder is the lighter first pass.
Passive subdomain enumeration from datasets. SubDomainizer mines JavaScript and GitHub for names and secrets those sources miss.
Mines JavaScript for endpoints and links. SubDomainizer pulls subdomains, cloud URLs, and secrets from scripts and from GitHub.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A URL is crawled by katana for JavaScript, then SubDomainizer mines those scripts for subdomains and secrets written as output.
Facts on this page come from the live Trickest tool library.