SubHunter v2

Subdomain recon tool. Queries crt.sh and HackerTarget in parallel, resolves IPs, detects CDN, and scans ports.

Build

# Linux/macOS
bash build.sh

# Windows (PowerShell)
./build.ps1

Binaries output to ./dist/.

Or build manually:

go build -o subhunter .        # Linux
go build -o SubHunter.exe .    # Windows

Usage

Run the binary, enter a root domain when prompted.

example.com   ✓
google.com    ✓
https://...   ✗
sub.x.com     ✗

Output

Column	Description
Subdomain	Discovered host
IP	Resolved address
Provider	Detected CDN/host
CDN	Behind CDN?
Open Ports	Scanned ports (skipped if CDN)

Ports checked: 21 22 25 80 443 3306 5432 8080 8443

Sources

• crt.sh — certificate transparency logs
• HackerTarget — passive DNS

Requirements

Go 1.19+