subzuf

KO | EN

gitlite — search

#javascript #python #hacktoberfest #golang #deep-learning #docker #macos #nodejs #windows #awesome #cli #awesome-list #security #mcp

(★ 156)

a smart DNS response-guided subdomain fuzzer

subzuf Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

subzuf
======

*subzuf* is a smart subdomain fuzzer coupled with an immensly simple but 
effective DNS reponse-guided algorithm. It utilizes a provided set of input 
data, like a tailored wordlist or historical DNS/TLS records, to accurately 
synthesize more corresponding domain names and expand them even further in a 
loop based on information gathered during DNS scan. This somewhat different 
approach to subdomain enumeration in most cases allows to discover more 
subdomains with significantly reduced time and resources.

![Demo](https://raw.githubusercontent.com/elceef/subzuf/main/misc/demo.gif)

In short, *subzuf* can be summarized by the following:

- Generates carefully selected candidates and uncover completely new subdomains 
during DNS enumeration scans
- Efficient multi-threaded DNS client capable of resolving thousands of domains 
per second
- Wildcard detection in two modes: filter (default, slightly slower but 
accurate) and reject (resource-saving)
- Accepts wordlist or domain names or a mix of both as input
- Requires essentially no configuration or fine-tuning
- Works right of out the box - no external dependencies or bizzare requirements
- Easily chainable with other tools

Installation
------------

```
$ git clone https://github.com/elceef/subzuf.git
$ cd subzuf
$ pip install .
$ subzuf --help
```

*subzuf* itself is just a single file which has no external dependencies - you 
can move it anywhere you need.

Quick examples
--------------

Using the attached scripts, collect publicly available data related to the 
target domain and provide it as input:

```
$ ./scripts/_subfind.sh example.com | subzuf example.com
```

Provide a text file as input, save JSON output to a file, and display results 
in CSV format:

```
$ cat wordlist.txt | subzuf example.com | tee out.zuf | ./scripts/json2csv.sh
```

Usage tips
----------

- The most efficient enumeration happens not with enormous or random input but 
with a mix of targeted test cases generated from OSINT and tailored wordlist.
- Input data is validated and everything that can't be quickly "fixed" on the 
fly will be silently skipped.
- By default the number of threads is auto-selected based on available CPU 
cores, which is a safe and in many cases sufficient value. Although it often 
pays off to increase this number, keep in mind that at some point speed does 
not increase linearly with the number of threads.
- Keep an eye at the error ratio in the status line. It should be reasonably 
low, say less than 1%. The most common errors are socket timeouts due to: 
congested and poor quality network links, slow DNS resolvers, rate-limiting, 
overloaded authoritative nameservers.
- Cloudflare and Google public DNS resolvers are used by default and 
considered reliable. Feel free to supply your own list of DNS resolvers. 
Although resolvers undergo basic validation test, please ensure that they can 
handle higher loads. Poor quality DNS resolvers will cause excessive timeout 
errors or refused/servfail status responses.
- Colourful CLI output is auto-selected when an interactive terminal is 
detected. Otherwise JSON is used by default. Output format can be always 
enforced with the optional command line argument.

Known limitations and common-sense risks
----------------------------------------

- Active DNS enumeration involves many thousands of queries in a relatively 
short period of time. Keep in mind that such a volume of DNS messages might not 
go unnoticed at the target.
- Virtual machines with NAT network adapters are generally not suitable for 
handling hundreds of DNS packets per second and will likely cause timeout 
errors.
- Built-in DNS client has a bare-minimum implementation required for the task 
and does not support DoH - use a proxy solution if really necessary.

Contact
-------

Questions? Don't hesitate to contact the author. Any feedback is appreciated.

subzuf

subzuf Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

subzuf

subzuf Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README