SubBrute – Subdomain Brute-forcing Tool

SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain brute-forcing tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting. This design also provides a layer of anonymity, as SubBrute does not send traffic directly to the target’s name servers.

There are various other options with similar capabilities, such as:

– InstaRecon – Automated Subdomain Discovery Tool
– dnsmap 0.22 Released – Subdomain Bruteforcing Tool
– DNSenum – Domain Information Gathering Tool
– Complemento v0.6 – ReverseRaider Subdomain Scanner
– DNSRecon – DNS Enumeration Script
– Recon-ng – Web Reconnaissance Framework

Features

• Fast, multi-threaded and comes with more than 2000 high quality nameservers in resolver.txt
• Nameservers are verified when they are needed. A seperate thread is responsible creating a feed of nameservers, and corresponding wildcard blacklist.
• SubBrute is now a DNS spider that recursively crawls enumerated DNS records. This feature boosted *.google.com from 123 to 162 subdomains.
• –type enumerate an arbitrary record type (AAAA, CNAME, SOA, TXT, MX…)
• -s can now read subdomains from result files.
• The subdomains enumerated from previous scans can now be used as input to enumerate other DNS records.

Usage

You can download SubBrute here:

– subbrute-source-77.zip
– windows-subbrute.zip

Or read more here.