loading
Loading content
loading
Recon
Subdomain enumeration with optional probing, takeover checks, and HTML reports.
overview
sudomy collects subdomains for a target and then runs analysis steps on top of them. It pulls names from passive sources, can brute force with --bruteforce, and resolves results into a deduplicated host list. From there it can layer HTTP probing, status codes, technology identification, and screenshots in the same invocation.
Flags toggle each stage. Run a broad pass with --all, aim --httpx or --takeover, add --dnsprobe, or emit --html and --graph for a readable report. Supply a config file when you want API keys for more passive sources.
Trickest provides sudomy as a managed Recon node. Input a domain list and optional config; take a FOLDER of results. Prefer subfinder or amass when you only need names. Prefer httpx alone when the host list already exists.
source github.com/screetsec/Sudomy
use cases
Enable --all to collect subdomains from every passive source, resolve them, and produce a clean host list ready for the rest of the workflow.
Turn on --httpx, --status-code, and --apps-identifier so the output already tells you which hosts are live and what they run.
Switch on --takeover so dangling, claimable records surface in the same run that found the subdomains.
Emit --html and --graph to hand a readable map of the attack surface to teammates without re-rendering the raw data.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | domains of the websites to scan |
| config | FILE | · | Config file for API keys and webhook URLs |
| all | BOOLEAN | --all | Running all Enumeration, no nmap & gobuster |
| source | STRING | --source | Use source for Enumerate Subdomain |
| httpx | BOOLEAN | --httpx | Perform httpx multiple probers using retryablehttp |
| takeover | BOOLEAN | --takeover | Subdomain TakeOver Vulnerabilty Scanner |
| bruteforce | BOOLEAN | --bruteforce | Bruteforce Subdomain Using Gobuster (Wordlist: ALL Top SecList DNS) |
| html | BOOLEAN | --html | Make report output into HTML |
Showing key inputs. sudomy exposes 23 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| all | BOOLEAN | --all | Running all Enumeration, no nmap & gobuster |
| html | BOOLEAN | --html | Make report output into HTML |
| graph | BOOLEAN | --graph | Network Graph Visualization |
| httpx | BOOLEAN | --httpx | Perform httpx multiple probers using retryablehttp |
| config | FILE | · | Config file for API keys and webhook URLs |
| source | STRING | --source | Use source for Enumerate Subdomain |
| db-port | STRING | --db-port | Collecting port from 3rd Party default=shodan |
| domains | FILE | · | domains of the websites to scan |
| dnsprobe | BOOLEAN | --dnsprobe | Perform multiple dns queries (dnsprobe) |
| nmap-top | BOOLEAN | --nmap-top | Port scanning with top-ports using nmap from domain list |
| no-probe | BOOLEAN | --no-probe | Do not perform httprobe |
| resolver | BOOLEAN | --resolver | Convert domain lists to resolved IP lists without duplicates |
| takeover | BOOLEAN | --takeover | Subdomain TakeOver Vulnerabilty Scanner |
| cloudfare | BOOLEAN | --cloudfare | Check an IP is Owned by Cloudflare |
| gwordlist | BOOLEAN | --gwordlist | Generate wordlist based on collecting url resources (Passive) |
| websocket | BOOLEAN | --websocket | WebSocket Connection Check |
| bruteforce | BOOLEAN | --bruteforce | Bruteforce Subdomain Using Gobuster (Wordlist: ALL Top SecList DNS) |
| no-passive | BOOLEAN | --no-passive | Do not perform passive subdomain enumeration |
| ping-sweep | BOOLEAN | --ping-sweep | Check live host using methode Ping Sweep |
| screenshot | BOOLEAN | --screenshot | Screenshots a list of website (default: gowitness) |
| status-code | BOOLEAN | --status-code | Get status codes, response from domain list |
| extract-params | BOOLEAN | --extract-params | Collecting URL Parameter from Engine |
| apps-identifier | STRING | --apps-identifier | Identify technologies on website (ex: webanalyze) |
example
# sudomy: full passive enum plus httpx probing and an HTML report for example.comsudomy --all --httpx --html --dnsprobeapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comcdn.example.comgitlab.example.comwww.example.comguidance
Use sudomy when you want one node for the early recon loop: passive enumeration, resolve, probing, and optional takeover checks. For just the raw subdomain set, subfinder or amass are leaner. For probing alone on an existing list, reach straight for httpx.
Pure passive subdomain enumeration. Simpler when you only need the names, not the recon pipeline around them.
Deeper enumeration and mapping with active and passive sources. Heavier than a sudomy passive pass.
OSINT-focused, also pulls emails and names. sudomy leans into resolving, probing, and takeover.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain list feeds sudomy, which enumerates, resolves, and probes subdomains and writes the recon results as a queryable output.
Facts on this page come from the live Trickest tool library.