Domained – Multi Tool Subdomain Enumeration
Click the icon to Follow me:- 
A domain name enumeration tool
The tools contained in domained requires Kali Linux (preferred) or Debian 7+ and Recon-ng
domained uses several subdomain enumeration tools and wordlists to create a unique list of subdomains that are passed to EyeWitness for reporting with categorized screenshots, server response headers and signature based default credential checking. (resources are saved to ./bin and output is saved to ./output)
Initial Install:
The world's most advanced processor in the desktop PC gaming segment Can deliver ultra-fast 100+ FPS performance in the world's most popular games 6 cores and 12 processing threads bundled with the quiet AMD wraith stealth cooler max temps 95°C 4 2 G... read more
(as of January 26, 2021 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
AMD's fastest 6 core processor for mainstream desktop, with 12 processing threads Can deliver elite 100+ FPS performance in the world's most popular games Bundled with the quiet, capable AMD Wraith Stealth cooler 4.6 GHz Max Boost, unlocked for overc... read more
(as of January 26, 2021 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
AMD's fastest 8 core processor for mainstream desktop, with 16 procesing threads Can deliver elite 100+ FPS performance in the world's most popular games Cooler not included, high-performance cooler recommended 4.7 GHz Max Boost, unlocked for overclo... read more
(as of January 26, 2021 - More infoProduct prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on [relevant Amazon Site(s), as applicable] at the time of purchase will apply to the purchase of this product.)
- domained tools:
python3 domained.py --install - Python required modules:
sudo pip install -r ./ext/requirements.txt
Other Dependencies:
- ldns library for DNS programming:
sudo apt-get install libldns-dev -y
- Go Programming Language:
sudo apt-get install golang
NOTE: This is an active recon – only perform on applications that you have permission to test against.
Tools leveraged:
Subdomain Enumeraton Tools:
- Sublist3r by Ahmed Aboul-Ela
- enumall by Jason Haddix
- Knock by Gianni Amato
- Subbrute by TheRook
- massdns by B. Blechschmidt
- Recon-ng by Tim Tomes (LaNMaSteR53)
- Amass by Jeff Foley (caffix)
- SubFinder by by Ice3man543
Reporting + Wordlists:
- EyeWitness by ChrisTruncer
- SecList (DNS Recon List) by Daniel Miessler
- LevelUp All.txt Subdomain List by Jason Haddix
Usage
First Step:
Install Required Python Modules: sudo pip install -r ./ext/requirements.txt
Install Tools: sudo python3 domained.py --install
Example 1: python3 domained.py -d example.com
Uses subdomain example.com (Sublist3r (+subbrute), enumall, Knock, Amass, and SubFinder)
Example 2: python3 domained.py -d example.com -b -p --vpn
Uses subdomain example.com with seclist subdomain list bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall, and SubFinder), adds ports 8443/8080 and checks if on VPN
Example 3: python3 domained.py -d example.com -b --bruteall
Uses subdomain example.com with large-all.txt bruteforcing (massdns, subbrute, Sublist3r, Amass, enumall and SubFinder)
Example 4: python3 domained.py -d example.com --quick
Uses subdomain example.com and only Amass and SubFinder
Example 5: python3 dom ained.py -d example.com --quick --notify
Uses subdomain example.com, only Amass and SubFinder and notification
Example 6: python3 domained.py -d example.com --noeyewitness
Uses subdomain example.com with no EyeWitness
Note: --bruteall must be used with the -b flag| Option | Description |
|---|---|
| –install/–upgrade | Both do the same function – install all prerequisite tools |
| –vpn | Check if you are on VPN (update with your provider) |
| –quick | Use ONLY Amass and SubFinder |
| –bruteall | Bruteforce with JHaddix All.txt List instead of SecList |
| –fresh | Delete old data from output folder |
| –notify | Send Pushover or Gmail Notifications |
| –active | EyeWitness Active Scan |
| –noeyewitness | No Eyewitness |
| -d | The domain you want to preform recon on |
| -b | Bruteforce with subbrute/massdns and SecList wordlist |
| -s n | Only HTTPs domains |
| -p | Add port 8080 for HTTP and 8443 for HTTPS |
Notifications
- Complete the ext/notifycfg.ini for Pushover or Gmail notifications. (Enable must be set to True)
- Please see the Pushover API info here and instructions on how to allow less secure apps on your gmail account here
To-Do List
You may be interested in...
- Multiple Domains
Notifications- Subdomains from censys
- Subdomains from Shodan
- Web Frontend/Dashboard
Add SubFinder
Thank You to Contributors
- ccsplit – Multiple code improvements including the ability to run domained from any directory
- jafoca – Massdns fix
- mortymorty – SecList brute file fix
- Chan9390 – Updates to the requirements.txt
- dainok – Python 3.6+ fixes
- Apoorv Raj Saxena – Added SubFinder
Major Updates
- 07-15-2017: Updated to include error handling and updated reconnaissance techniques from Bugcrowd’s LevelUp Conference (including subbrute/masscan and subdomain lists) – influenced by Jason Haddix’s talk Bug Hunter’s Methodology 2.0
- 08-09-2017: Various fixes (+ phantomjs error), added –fresh option, removed redundant PyBrute folder from output and added pip requirements.txt
- 08-15-2017: Added notification (–notify) option with Pushover or Gmail support
- 08-18-2017: Moved repo from OrOneEqualsOne/reconned
- 09-28-2017: Updated for Recon-ng dependency + Python3 changes
- 06-20-2018: Added Amass and option for no EyeWitness
- 10-12-2018: Added SubFinder
Download Domained
