SubBrute – Tool to Enumerate DNS Records and Subdomains

SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers. This design also provides a layer of anonymity, as SubBrute does not send traffic directly to the target’s name servers.

Subbrute - Tool to Enumerate DNS Records and Subdomains
Subbrute – Tool to Enumerate DNS Records and Subdomains

Scanning and enumeration require that the user be fully hidden to avoid being detected or blocked by network security devices. This make such tool widely used and it can be an addition during a penetration testing session.

Current supported options with this tool are:

  • -h, –help – show this help message and exit
  • -s SUBS, –subs=SUBS – A list of subdomains, accepts a single file, or a directory of files. default = ‘names.txt’
  • -r RESOLVERS, –resolvers=RESOLVERS- A list of DNS resolvers, if this list is empty it will use OS’s internal resolver default = ‘resolvers.txt’
  • -t TARGETS, –targets_file=TARGETS- A file containing a newline delimited list of domains to brute force.
  • -p, -P – Print data from found DNS records
  • -c PROCESS_COUNT, Number of lookup theads to run. default = 8
  • -v, –verbose Print debug information

You can read more and download this tool over here:

Notify of
Inline Feedbacks
View all comments