subenum.sh

# usage: ./subenum [target domain]
target=$1

# Get subdomains from subfinder
subfinder -d $target -silent > subdomains1.txt

# Get subdomains from assetfinder
assetfinder $target -subs-only | grep $target$ > subdomains2.txt

# Get subdomains from knockpy
knockpy --no-http $target
cat knockpy_report/$target* | grep -oP '[a-z0-9]+\.'$target | sort -u | uniq > subdomains3.txt

# Get subdomains from sublist3r
sublist3r.py -n -d $target -o subdomains4.txt

# Get subdomains from findomain
findomain -t $target -q > subdomains5.txt

# bruteforce subdomains
awk -v host=$target '{print $0"."host}' /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt > massdnslist
massdns massdnslist -r /usr/share/seclists/Miscellaneous/dns-resolvers.txt -o S -t A -q | awk -F". " '{print $1}' | sort -u  > subdomains6.txt

# sort and organize the outputs
cat subdomains*.txt | sort -u | uniq >> finaldomains.txt
echo "domains found: "$(cat finaldomains.txt | wc -l)

# check for subdomain takeover from subtaker
python3 /home/schizo/Desktop/tools/subtaker/subtaker.py ./finaldomains.txt # save Vuln domains in a file by the tool itself

# check for subdomain takeover from SubOver
go run ~/Desktop/tools/SubOver/subover.go -l finaldomains.txt -o vulnsubs.txt

echo "-------------- tool finished -----------------\n"

if test -f "vulnsubs.txt"; then
	echo "SubOver tool result: "$(cat vulnsubs.txt | wc -l)" vulnerable subdomain\n"
	cat vulnsubs.txt
fi

echo "\n subtaker tool result: "$(cat vulnerable-Subs.txt | wc -l)" vulnerable subdomain\n"
cat vulnerable-Subs.txt

echo "--- happy hunting ^-^ ---\n"