subdiscover.sh

#!/usr/bin/env bash
set -euo pipefail

# subdiscover.sh - Passive subdomain discovery from multiple OSINT sources
# Outputs a wordlist compatible with: domainips.sh -w <output>
# Usage: ./subdiscover.sh -d <domain> [-o <output-file>]

readonly VERSION="1.0.0"
readonly TMPDIR_BASE="${TMPDIR:-/tmp}"
readonly WORK_DIR=$(mktemp -d "${TMPDIR_BASE}/subdiscover.XXXXXX")

trap 'rm -rf "$WORK_DIR"' EXIT

readonly RAW_FILE="${WORK_DIR}/raw.txt"
touch "$RAW_FILE"

usage() {
    cat <<EOF
subdiscover v${VERSION} - Passive Subdomain Discovery

Discovers subdomains from public OSINT sources. Output can be
piped directly into domainips.sh via the -w parameter.

Usage: $(basename "$0") -d <domain> [-o <output-file>]

Options:
    -d <domain>     Target domain (required)
    -o <file>       Output file (default: stdout)
    -q              Quiet mode (no progress output)
    -h              Show this help

Examples:
    $(basename "$0") -d example.com -o subs.txt
    ./domainips.sh -d example.com -w subs.txt

    # Or piped directly:
    $(basename "$0") -d example.com -o subs.txt && ./domainips.sh -d example.com -w subs.txt
EOF
    exit 0
}

log() {
    [[ "${QUIET}" == "true" ]] && return
    echo -e "\033[1;34m[*]\033[0m $1" >&2
}

warn() {
    echo -e "\033[1;33m[!]\033[0m $1" >&2
}

success() {
    echo -e "\033[1;32m[+]\033[0m $1" >&2
}

error() {
    echo -e "\033[1;31m[-]\033[0m $1" >&2
    exit 1
}

# Extract subdomains matching the target domain from raw text
extract_subs() {
    local domain="$1"
    local escaped
    escaped=$(echo "$domain" | sed 's/\./\\./g')
    # Match any word that ends with .domain.tld or is domain.tld itself
    grep -oiE "([a-zA-Z0-9]([a-zA-Z0-9_-]*[a-zA-Z0-9])?\.)*${escaped}" \
        | tr '[:upper:]' '[:lower:]' \
        | sed 's/\.$//' \
        | sort -u || true
}

# --- Sources ---

source_crtsh() {
    local domain="$1"
    log "  crt.sh (Certificate Transparency)..."

    local result
    result=$(curl -s --max-time 30 \
        "https://crt.sh/?q=%25.${domain}&output=json" 2>/dev/null || true)

    if [[ -z "$result" || "$result" == "null" ]]; then
        warn "  crt.sh: no results or unreachable"
        return
    fi

    local count
    count=$(echo "$result" \
        | jq -r '.[].name_value' 2>/dev/null \
        | extract_subs "$domain" \
        | tee -a "$RAW_FILE" \
        | wc -l | tr -d ' ')

    success "  crt.sh: ${count} entries"
}

source_alienvault() {
    local domain="$1"
    log "  AlienVault OTX..."

    local result
    result=$(curl -s --max-time 20 \
        "https://otx.alienvault.com/api/v1/indicators/domain/${domain}/passive_dns" \
        2>/dev/null || true)

    if [[ -z "$result" ]]; then
        warn "  AlienVault: unreachable"
        return
    fi

    local count
    count=$(echo "$result" \
        | jq -r '.passive_dns[]?.hostname' 2>/dev/null \
        | extract_subs "$domain" \
        | tee -a "$RAW_FILE" \
        | wc -l | tr -d ' ')

    success "  AlienVault OTX: ${count} entries"
}

source_hackertarget() {
    local domain="$1"
    log "  HackerTarget..."

    local result
    result=$(curl -s --max-time 20 \
        "https://api.hackertarget.com/hostsearch/?q=${domain}" \
        2>/dev/null || true)

    if [[ -z "$result" || "$result" == *"error"* ]]; then
        warn "  HackerTarget: no results or rate-limited"
        return
    fi

    local count
    count=$(echo "$result" \
        | cut -d',' -f1 \
        | extract_subs "$domain" \
        | tee -a "$RAW_FILE" \
        | wc -l | tr -d ' ')

    success "  HackerTarget: ${count} entries"
}

source_rapiddns() {
    local domain="$1"
    log "  RapidDNS..."

    local result
    result=$(curl -s --max-time 20 \
        "https://rapiddns.io/subdomain/${domain}?full=1" \
        2>/dev/null || true)

    if [[ -z "$result" ]]; then
        warn "  RapidDNS: unreachable"
        return
    fi

    local count
    count=$(echo "$result" \
        | extract_subs "$domain" \
        | tee -a "$RAW_FILE" \
        | wc -l | tr -d ' ')

    success "  RapidDNS: ${count} entries"
}

source_wayback() {
    local domain="$1"
    log "  Wayback Machine (web.archive.org)..."

    local result
    result=$(curl -s --max-time 30 \
        "https://web.archive.org/cdx/search/cdx?url=*.${domain}/*&output=text&fl=original&collapse=urlkey&limit=5000" \
        2>/dev/null || true)

    if [[ -z "$result" ]]; then
        warn "  Wayback Machine: no results or unreachable"
        return
    fi

    local count
    count=$(echo "$result" \
        | extract_subs "$domain" \
        | tee -a "$RAW_FILE" \
        | wc -l | tr -d ' ')

    success "  Wayback Machine: ${count} entries"
}

source_urlscan() {
    local domain="$1"
    log "  urlscan.io..."

    local result
    result=$(curl -s --max-time 20 \
        "https://urlscan.io/api/v1/search/?q=domain:${domain}&size=1000" \
        2>/dev/null || true)

    if [[ -z "$result" ]]; then
        warn "  urlscan.io: unreachable"
        return
    fi

    local count
    count=$(echo "$result" \
        | jq -r '.results[]?.page?.domain' 2>/dev/null \
        | extract_subs "$domain" \
        | tee -a "$RAW_FILE" \
        | wc -l | tr -d ' ')

    success "  urlscan.io: ${count} entries"
}

source_threatminer() {
    local domain="$1"
    log "  ThreatMiner..."

    local result
    result=$(curl -s --max-time 20 \
        "https://api.threatminer.org/v2/domain.php?q=${domain}&rt=5" \
        2>/dev/null || true)

    if [[ -z "$result" ]]; then
        warn "  ThreatMiner: unreachable"
        return
    fi

    local count
    count=$(echo "$result" \
        | jq -r '.results[]?' 2>/dev/null \
        | extract_subs "$domain" \
        | tee -a "$RAW_FILE" \
        | wc -l | tr -d ' ')

    success "  ThreatMiner: ${count} entries"
}

# --- Main ---

DOMAIN=""
OUTPUT_FILE=""
QUIET=false

while getopts "d:o:qh" opt; do
    case "$opt" in
        d) DOMAIN="$OPTARG" ;;
        o) OUTPUT_FILE="$OPTARG" ;;
        q) QUIET=true ;;
        h) usage ;;
        *) usage ;;
    esac
done

[[ -z "$DOMAIN" ]] && error "Domain is required. Use -d <domain>"

if ! echo "$DOMAIN" | grep -qE '^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)+$'; then
    error "Invalid domain format: ${DOMAIN}"
fi

log "Passive subdomain discovery for: ${DOMAIN}"
log "========================================="
log "Querying OSINT sources..."

# Query all sources
source_crtsh "$DOMAIN"
source_alienvault "$DOMAIN"
source_hackertarget "$DOMAIN"
source_rapiddns "$DOMAIN"
source_wayback "$DOMAIN"
source_urlscan "$DOMAIN"
source_threatminer "$DOMAIN"

# Deduplicate and sort
FINAL=$(sort -u "$RAW_FILE")
TOTAL=$(echo "$FINAL" | grep -c '.' || true)

log "========================================="
success "Total unique subdomains found: ${TOTAL}"

if [[ -n "$OUTPUT_FILE" ]]; then
    echo "$FINAL" > "$OUTPUT_FILE"
    success "Saved to: ${OUTPUT_FILE}"
    log ""
    log "Next step:"
    log "  ./domainips.sh -d ${DOMAIN} -w ${OUTPUT_FILE} -o results.csv"
else
    # Output to stdout
    echo "$FINAL"
fi