SubDomainizer — Reconnaissance | Tools

Description

SubDomainizer is a tool designed to find hidden subdomains and secrets present in inline JavaScript and external JavaScript files of a given URL. It also finds S3 buckets, cloud URLs, and other interesting data from the responses.

Installation

BASH

                            git clone https://github.com/nsonaniya2010/SubDomainizer.git
cd SubDomainizer
pip install -r requirements.txt
                        

Basic Usage

BASH

                            # Scan a single URL
python SubDomainizer.py -u https://target.com

# Save subdomains to file
python SubDomainizer.py -u https://target.com -o subs.txt
                        

Advanced Usage

                        BASH
                        
                            # Scan from a list of URLs
python SubDomainizer.py -l urls.txt -o subs.txt

# Get cloud URLs (S3, Azure, GCP)
python SubDomainizer.py -u https://target.com -cloud

# Set cookie for authenticated scanning
python SubDomainizer.py -u https://target.com -c "session=abc123"

# Output to different formats
python SubDomainizer.py -u https://target.com -o subs.txt -oS secrets.txt

Common Workflows

BASH

                            # Find subdomains hidden in JS files
python SubDomainizer.py -u https://target.com -o js-subs.txt

# Chain with other subdomain tools
subfinder -d target.com -silent | httpx -silent | xargs -I {} python SubDomainizer.py -u {}
                        