Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Recon

Enumerate, resolve, and probe subdomains in one node

Subdomain enumeration with optional probing, takeover checks, and HTML reports.

Agent
Run the full recon loop in one passProbe and fingerprint discovered hostsHunt subdomain takeovers during discovery

overview

What sudomy does

sudomy collects subdomains for a target and then runs analysis steps on top of them. It pulls names from passive sources, can brute force with --bruteforce, and resolves results into a deduplicated host list. From there it can layer HTTP probing, status codes, technology identification, and screenshots in the same invocation.

Flags toggle each stage. Run a broad pass with --all, aim --httpx or --takeover, add --dnsprobe, or emit --html and --graph for a readable report. Supply a config file when you want API keys for more passive sources.

Trickest provides sudomy as a managed Recon node. Input a domain list and optional config; take a FOLDER of results. Prefer subfinder or amass when you only need names. Prefer httpx alone when the host list already exists.

source github.com/screetsec/Sudomy

use cases

Where sudomy fits

Run the full recon loop in one pass

Enable --all to collect subdomains from every passive source, resolve them, and produce a clean host list ready for the rest of the workflow.

Probe and fingerprint discovered hosts

Turn on --httpx, --status-code, and --apps-identifier so the output already tells you which hosts are live and what they run.

Hunt subdomain takeovers during discovery

Switch on --takeover so dangling, claimable records surface in the same run that found the subdomains.

Generate an HTML report and graph

Emit --html and --graph to hand a readable map of the attack surface to teammates without re-rendering the raw data.

reference

sudomy inputs and flags

23 inputs
NameTypeFlagDescription
domainsFILE·domains of the websites to scan
configFILE·Config file for API keys and webhook URLs
allBOOLEAN--allRunning all Enumeration, no nmap & gobuster
sourceSTRING--sourceUse source for Enumerate Subdomain
httpxBOOLEAN--httpxPerform httpx multiple probers using retryablehttp
takeoverBOOLEAN--takeoverSubdomain TakeOver Vulnerabilty Scanner
bruteforceBOOLEAN--bruteforceBruteforce Subdomain Using Gobuster (Wordlist: ALL Top SecList DNS)
htmlBOOLEAN--htmlMake report output into HTML

Showing key inputs. sudomy exposes 23 inputs in total.

Full flag reference (23 inputs)
NameTypeFlagDescription
allBOOLEAN--allRunning all Enumeration, no nmap & gobuster
htmlBOOLEAN--htmlMake report output into HTML
graphBOOLEAN--graphNetwork Graph Visualization
httpxBOOLEAN--httpxPerform httpx multiple probers using retryablehttp
configFILE·Config file for API keys and webhook URLs
sourceSTRING--sourceUse source for Enumerate Subdomain
db-portSTRING--db-portCollecting port from 3rd Party default=shodan
domainsFILE·domains of the websites to scan
dnsprobeBOOLEAN--dnsprobePerform multiple dns queries (dnsprobe)
nmap-topBOOLEAN--nmap-topPort scanning with top-ports using nmap from domain list
no-probeBOOLEAN--no-probeDo not perform httprobe
resolverBOOLEAN--resolverConvert domain lists to resolved IP lists without duplicates
takeoverBOOLEAN--takeoverSubdomain TakeOver Vulnerabilty Scanner
cloudfareBOOLEAN--cloudfareCheck an IP is Owned by Cloudflare
gwordlistBOOLEAN--gwordlistGenerate wordlist based on collecting url resources (Passive)
websocketBOOLEAN--websocketWebSocket Connection Check
bruteforceBOOLEAN--bruteforceBruteforce Subdomain Using Gobuster (Wordlist: ALL Top SecList DNS)
no-passiveBOOLEAN--no-passiveDo not perform passive subdomain enumeration
ping-sweepBOOLEAN--ping-sweepCheck live host using methode Ping Sweep
screenshotBOOLEAN--screenshotScreenshots a list of website (default: gowitness)
status-codeBOOLEAN--status-codeGet status codes, response from domain list
extract-paramsBOOLEAN--extract-paramsCollecting URL Parameter from Engine
apps-identifierSTRING--apps-identifierIdentify technologies on website (ex: webanalyze)

example

Run sudomy

sudomy · command
# sudomy: full passive enum plus httpx probing and an HTML report for example.comsudomy --all --httpx --html --dnsprobe
sample output
api.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comcdn.example.comgitlab.example.comwww.example.com

guidance

Choosing sudomy

Use sudomy when you want one node for the early recon loop: passive enumeration, resolve, probing, and optional takeover checks. For just the raw subdomain set, subfinder or amass are leaner. For probing alone on an existing list, reach straight for httpx.

subfinder

Pure passive subdomain enumeration. Simpler when you only need the names, not the recon pipeline around them.

amass

Deeper enumeration and mapping with active and passive sources. Heavier than a sudomy passive pass.

theHarvester

OSINT-focused, also pulls emails and names. sudomy leans into resolving, probing, and takeover.

faq

sudomy questions

It resolves and deduplicates the names, then optionally probes with --httpx, captures --status-code and ports, identifies technologies, screenshots hosts, and scans for takeovers with --takeover.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run sudomy yourself

A domain list feeds sudomy, which enumerates, resolves, and probes subdomains and writes the recon results as a queryable output.

Open sudomy in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.