🔎 subdomain_enum.py

An orchestrator that runs several well-known subdomain-discovery tools, merges and de-duplicates their output, and probes which hosts are alive — in one command.

It doesn't reinvent enumeration; it glues together the tools recon engineers already trust and hands you a single clean list of live subdomains.

---

⚠️ Authorized use only

Enumerate assets you own or are explicitly authorized to assess (e.g. a bug-bounty scope). Reconnaissance against out-of-scope infrastructure may be illegal. See LICENSE.

---

Pipeline

domains.txt
   │
   ├─ subfinder   ┐
   ├─ amass       ├─ merge + dedupe ─► all_subdomains.txt
   └─ assetfinder ┘
                        │
                        └─ httpx ─► subdomains_alive.txt

Requirements

The script itself is pure Python (standard library only), but it shells out to these tools — install them first and make sure they're on your PATH:

Tool	Install
subfinder	go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
amass	go install github.com/owasp-amass/amass/v4/...@master
assetfinder	go install github.com/tomnomnom/assetfinder@latest
httpx	go install github.com/projectdiscovery/httpx/cmd/httpx@latest

Usage

# 1. List root domains, one per line
echo "example.com" > domains.txt

# 2. Run
python3 subdomain_enum.py

Output lands in output/:

File	Contents
all_subdomains.txt	Merged, de-duplicated subdomains from all sources
subdomains_alive.txt	Hosts that responded to httpx

Progress and errors are logged to the console and to subdomain_enum.log. Intermediate per-tool files are cleaned up automatically on success.

License

MIT — see LICENSE.