A small, open-source orchestration CLI for authorized subdomain reconnaissance. Subscan coordinates established third-party tools, normalizes their output, and helps security researchers avoid repetitive manual glue work.
Use Subscan only against systems you own or have explicit permission to test.
Reconnaissance often means running several tools, collecting overlapping output, checking which hosts are live, and then passing those results into follow-up checks. Subscan turns that workflow into one repeatable command while keeping the underlying tools visible and replaceable.
- Validates and normalizes target domain names before execution.
- Invokes external tools without a shell to reduce command-injection risk.
- Supports Sublist3r, Assetfinder, Findomain, Subfinder, and Amass.
- Probes discovered hosts with httpx and httprobe when installed.
- Can run Subjack and Subzy checks against live results.
- Deduplicates output into simple text files.
- Detects missing tools and continues with what is available.
- Includes unit tests and CI for Python 3.10, 3.11, and 3.12.
git clone https://github.com/bhatmuneeb1/subscan.git
cd subscan
python -m venv .venv
source .venv/bin/activate
python -m pip install -e .The Python package itself has no runtime dependency on the third-party reconnaissance tools. Install whichever external tools you want Subscan to orchestrate.
Check what is available:
subscan --check-toolsRun a scan against an authorized domain:
subscan example.comChoose an output directory:
subscan example.com --output results/exampleSkip takeover checks:
subscan example.com --skip-takeoverYou can also run the module directly:
python subscan.py example.comA typical run can create files such as:
example.com_output/
├── sublist3r.txt
├── assetfinder.txt
├── findomain.txt
├── subfinder.txt
├── amass.txt
├── subdomains.txt
├── alive_httpx.txt
├── alive_httprobe.txt
├── alive_subdomains.txt
└── subjack_results.txt
Exact files depend on which third-party tools are installed and return results.
python -m pip install -e . pytest
pytestGitHub Actions runs the test suite on supported Python versions for pushes and pull requests.
Contributions are welcome, especially improvements to reliability, portability, testing, structured output, documentation, and safe authorized-use workflows. See CONTRIBUTING.md.
If you find a vulnerability in Subscan itself, please follow SECURITY.md rather than opening a public issue with exploit details.
Subscan is being modernized from its original proof-of-concept script into a maintainable CLI. The current 0.2.x line focuses on safer process execution, reproducibility, testing, and contributor experience.
See CHANGELOG.md for notable changes.
MIT — see LICENSE.
Subscan is intended for security research, defensive assessment, education, and bug-bounty work where the operator has authorization. You are responsible for following applicable laws and each target's testing rules.