Sudomy is a subdomain enumeration tool to collect subdomains and analyzing domains performing automated reconnaissance (recon) for bug hunting / pentesting.

Features !

For recent time, Sudomy has these 20 features:

• Easy, light, fast and powerful. Bash script (controller) is available by default in almost all Linux distributions. By using bash script multiprocessing feature, all processors will be utilized optimally.
• Subdomain enumeration process can be achieved by using active method or passive method
  • Active Method
    • Sudomy utilize Gobuster tools because of its highspeed performance in carrying out DNS Subdomain Bruteforce attack (wildcard support). The wordlist that is used comes from combined SecList (Discover/DNS) lists which contains around 3 million entries
  • Passive Method
    • By evaluating and selecting the good third-party sites/resources, the enumeration process can be optimized. More results will be obtained with less time required. Sudomy can collect data from these well-curated 22 third-party sites.

• Test the list of collected subdomains and probe for working http or https servers. This feature uses a third-party tool, httprobe.
• Subdomain availability test based on Ping Sweep and/or by getting HTTP status code.
• The ability to detect virtualhost (several subdomains which resolve to single IP Address). Sudomy will resolve the collected subdomains to IP addresses, then classify them if several subdomains resolve to single IP address. This feature will be very useful for the next penetration testing/bug bounty process. For instance, in port scanning, single IP address won’t be scanned repeatedly
• Performed port scanning from collected subdomains/virtualhosts IP Addresses
• Testing Subdomain TakeOver attack (CNAME Resolver, DNSLookup, Detect NXDomain, Check Vuln)
• Taking Screenshots of subdomains default using gowitness or you can choice another screenshot tools, like (-ss webscreeenshot)
• Identify technologies on websites (category,application,version)
• Detection urls, ports, title, content-length, status-code, response-body probbing.
• Smart auto fallback from https to http as default.
• Data Collecting/Scraping open port from 3rd party (Default::Shodan), For right now just using Shodan [Future::Censys,Zoomeye]. More efficient and effective to collecting port from list ip on target [[ Subdomain > IP Resolver > Crawling > ASN & Open Port ]]
• Collecting Juicy URL & Extract URL Parameter ( Resource Default::WebArchive, CommonCrawl, UrlScanIO)
• Collect interesting path (api|.git|admin|etc), document (doc|pdf), javascript (js|node) and parameter
• Define path for outputfile (specify an output file when completed)
• Check an IP is Owned by Cloudflare
• Generate & make wordlist based on collecting url resources (wayback,urlscan,commoncrawl. To make that, we Extract All the paramater and path from our domain recon
• Generate Network Graph Visualization Subdomain & Virtualhosts
• Report output in HTML & CSV format
• Sending notifications to a slack channel