github-subdomains
Enumerates subdomains mentioned in GitHub code search. Needs a GitHub token. Catches hostnames that never hit Certificate Transparency.
Tags: github, subdomains, dorks
- Category
- recon
- Maintenance signal
- maintained
Use this when: Intake. Use this on a root you are allowed to resolve. The output is a host list, not a finding.
Install
go
go install github.com/gwen001/github-subdomains@latestCommand templates
Code search
github-subdomains -d {domain} -t {token} -o {output}