For recent time, Sudomy has these 13 features:
Easy, light, fast and powerful. Bash script is available by default in almost all Linux distributions. By using bash script multiprocessing feature, all processors will be utilized optimally.
Subdomain enumeration process can be achieved by using active method or passive method
Sudomy utilize Gobuster tools because of its highspeed performance in carrying out DNS Subdomain Bruteforce attack (wildcard support). The wordlist that is used comes from combined SecList (Discover/DNS) lists which contains around 3 million entries
By selecting the good third-party sites, the enumeration process can be optimized. More results will be obtained with less time required. Sudomy can collect data from these well-curated 18 third-party sites:
Test the list of collected subdomains and probe for working http or https servers. This feature uses a third-party tool, httprobe.
Subdomain availability test based on Ping Sweep and/or by getting HTTP status code.
The ability to detect virtualhost (several subdomains which resolve to single IP Address). Sudomy will resolve the collected subdomains to IP addresses, then classify them if several subdomains resolve to single IP address. This feature will be very useful for the next penetration testing/bug bounty process. For instance, in port scanning, single IP address won’t be scanned repeatedly
Performed port scanning from collected subdomains/virtualhosts IP Addresses
Testing Subdomain TakeOver attack
Taking Screenshotsof subdomains
Identify technologies on websites
Data Collecting/Scraping open port from 3rd party (Default::Shodan), For right now just using Shodan [Future::Censys,Zoomeye]. More efficient and effective to collecting port from list ip on target [[ Subdomain > IP Resolver > Crawling > ASN & Open Port ]]
Collecting & Extract URL Parameter
Report output in HTML or CSV format