Find subdomains quickly using Python. Supports HTTP/HTTPS, wordlists, and output saving.
- ๐ Scans for subdomains using your own or default wordlist
- ๐ Supports
httpsprotocol only (no noise fromhttp) - ๐ Fetches subdomains directly from crt.sh using
--include-crtsh - ๐งต Fast multithreaded scanning using Python's
ThreadPoolExecutor - ๐พ Save found subdomains to an output file using
-o - โก Beginner-friendly and easy to use
- ๐ฅ Graceful exit with
Ctrl + C - ๐ง Merges wordlist + crt.sh results without duplicates
git clone https://github.com/yourusername/subfury.git
2. Navigate into the folder
cd SubFury
3. Install requirements
pip install -r requirements.txtUsage
๐ Basic Usage
python3 subfury.py example.com
๐ With Wordlist
python3 subfury.py example.com -w wordlist.txt
๐ Include crt.sh Subdomains
python3 subfury.py example.com --include-crtsh
๐พ Save Output to File
python3 subfury.py example.com -o output.txt
๐งฉ Combine All Options
python3 subfury.py example.com -w wordlist.txt --include-crtsh -o output.txt
Sample Output
[+] Subdomain Found: http://admin.example.com (Status: 200)
[+] Subdomain Found: https://mail.example.com (Status: 302)
๐งพ Requirements
pip3 install -r requirements.txt
๐จโ๐ป Author
Pavan
๐ https://pavansec.pro
๐ฌ Young cybersecurity enthusiast from India ๐ฎ๐ณ
This tool is for educational and authorized security testing only. Do not use on systems you donโt own or have permission to test.
โญ If you like this tool, give it a star on GitHub to support the project!