subdomain_enumeration.py

import requests
import threading
import time

MAX_THREADS = 100
timeout = 5

def checkSubDomain(domain, subdomain, found_subdomains):
    https_url = f"https://{subdomain}.{domain}"
    try:
        response = requests.get(https_url, timeout=timeout)
        if response.status_code == 200:
            found_subdomains.append(f"{subdomain}.{domain}")
            print(f"{subdomain}.{domain}")
            return f"{subdomain}.{domain}"
    except requests.exceptions.Timeout:
        pass
    except requests.exceptions.RequestException:
        http_url = f"http://{subdomain}.{domain}"
        try:
            response = requests.get(http_url, timeout=timeout)
            if response.status_code == 200:
                found_subdomains.append(http_url)
                print(f"{http_url}")
                return http_url
        except requests.exceptions.Timeout:
            pass
        except requests.exceptions.RequestException:
            pass
    return None

def load_subdomains(filename="wordlist/Subdomain.txt"):
    try:
        with open(filename, "r") as file:
            return [line.strip() for line in file.readlines()]
    except FileNotFoundError:
        print(f"{filename} not found.")
        return []

def worker(domain, subdomain, found_subdomains):
    checkSubDomain(domain, subdomain, found_subdomains)

def thread_subdomain_check(domain, subdomains):
    found_subdomains = []
    threads = []

    print("Subdomain found")

    for sub in subdomains:
        while len(threads) >= MAX_THREADS:
            for thread in threads:
                thread.join()
            threads.clear()

        thread = threading.Thread(target=worker, args=(domain, sub, found_subdomains))
        thread.start()
        threads.append(thread)

        

    for thread in threads:
        thread.join()

    return found_subdomains

def run_subdomain_enumeration():
    domain = input("Enter domain name (e.g. google.com): ") or 'google.com'
    subdomains = load_subdomains()

    if not subdomains:
        print("No subdomains found.")
    else:
        start_time = time.time()
        found_subdomains = thread_subdomain_check(domain, subdomains)
        elapsed_time = time.time() - start_time
        print(f"Scan completed in {elapsed_time:.2f} seconds.")

if __name__ == '__main__':
    run_subdomain_enumeration()