Sudomy — Your Swiss Army Knife for Subdomain Analysis

When Subdomains Reveal More Than They Seem

Familiar with the situation where standard subdomain enumeration tools give scattered results, and manual analysis takes hours? Meet Sudomy — a framework that turns the tedious reconnaissance process into an automated pipeline. With over 2.2k stars on GitHub, this project has already earned the community's trust.

What Can Sudomy Do?

Sudomy isn't just a subdomain scanner — it's a complete framework for automated reconnaissance. Here are its key capabilities:

1. Dual Enumeration Method:

   • Passive: uses 22 trusted sources like Shodan, VirusTotal, and Censys
   • Active: brute-force with a wordlist containing 3 million entries

2. Automated Analysis:

   • Health checks (HTTP/HTTPS)
   • Technology fingerprinting (Webanalyze)
   • Page screenshots (gowitness)
   • Subdomain Takeover detection

3. Advanced Features:

   • Wordlist generation based on discovered data
   • Subdomain network visualization
   • Slack notifications

# Пример запуска с максимальным функционалом
./sudomy -d example.com -dP -eP -rS -cF -pS -tO -gW --httpx --dnsprobe -aI webanalyze -sS

Why It's Better Than Alternatives?

Comparison with Sublist3r and Subfinder shows Sudomy's advantages:

• Optimized resource usage
• More comprehensive subdomain coverage
• Integration of multiple tools in a single framework

How It Works Under the Hood

Sudomy is written in Bash and Python, making it lightweight and versatile. Under the hood it uses:

• Gobuster for brute-force
• httprobe for availability checks
• nmap for port scanning
• gowitness for screenshots

The architecture is meticulously designed — from multiprocessing in Bash to smart result caching.

Who Will Benefit from This?

1. Pentesters: Automating routine reconnaissance tasks
2. Bug Bounty Hunters: Finding vulnerable subdomains
3. Administrators: Auditing their own infrastructure
4. Researchers: Gathering data for OSINT

How to Get Started?

Installation is simple even for beginners:

git clone --recursive https://github.com/screetsec/Sudomy.git
cd Sudomy
python3 -m pip install -r requirements.txt

For Docker enthusiasts, there's a ready-made image:

docker pull screetsec/sudomy:v1.2.1-dev

Verdict: Is It Worth Trying?

If you need to:

• Quickly get a complete picture of subdomains
• Automate the reconnaissance process
• Have a single tool instead of a collection of scripts

— Sudomy will be an excellent choice. The project is actively developing, and the community has already recognized its potential. As the README states: "It may not be perfect, but pull requests are always welcome!"

For those who want to dig deeper:

• Official guide
• Demo on YouTube
• Research paper