brute

With this command you can use the brute force technique to discover subdomains on a domain

Argument List

All arguments below can be used with the brute command, see here for common use cases

NameShortDescription
--domain-dTarget domain to be scanned
--wordlist-wWordlist file to be used during attack
--print-pIf sets, output will be logged on stdout
--output-oSet output format (txt, csv, json, html)
--resolver-timeoutIP resolver timeout
--resolver-concurrency IP resolver concurrency level    
--help-hPrint help

Common Use Cases

  • Run a basic brute force attack with default settings

    ~$ subscan brute -d example.com -w wordlist.txt
    
  • Increase resolver concurrency to improve attack speed

    ~$ subscan brute -d example.com -w wordlist.txt --resolver-concurrency 200
    
  • Fine-tune IP address resolver component according to your network

    ~$ subscan brute -d example.com -w wordlist.txt --resolver-timeout 1 --resolver-concurrency 100
    
  • Skip creating a report and print results directly to stdout

    ~$ subscan brute -d example.com -w wordlist.txt --print