+
+## Description:
+
+Subdomain takeover is a common vulnerability that allows an attacker to gain control over a subdomain of a target domain and redirect users intended for an organization's domain to a website that performs malicious activities, such as phishing campaigns,
+stealing user cookies, etc. It occurs when an attacker gains control over a subdomain of a target domain.
+Typically, this happens when the subdomain has a CNAME in the DNS, but no host is providing content for it.
+Subhunter takes a given list of subdomains and scans them to check this vulnerability.
+
+## Features:
+
+- Auto update
+- Uses random user agents
+- Built in Go
+- Uses a fork of fingerprint data from well known sources ([can-i-take-over-xyz](https://github.com/EdOverflow/can-i-take-over-xyz/blob/master/README.md))
+
+## Installation:
+
+### Option 1:
+
+[Download](https://github.com/Nemesis0U/Subhunter/releases) from releases
+
+### Option 2:
+Build from source:
+
+ $ git clone https://github.com/Nemesis0U/Subhunter.git
+ $ go build subhunter.go
+
+## Usage:
+
+### Options:
+
+```
+Usage of subhunter:
+ -l string
+ File including a list of hosts to scan
+ -o string
+ File to save results
+ -t int
+ Number of threads for scanning (default 50)
+ -timeout int
+ Timeout in seconds (default 20)
+```
+
+### Demo (Added fake fingerprint for POC):
+
+```
+./Subhunter -l subdomains.txt -o test.txt
+
+ ____ _ _ _
+ / ___| _ _ | |__ | |__ _ _ _ __ | |_ ___ _ __
+ \___ \ | | | | | '_ \ | '_ \ | | | | | '_ \ | __| / _ \ | '__|
+ ___) | | |_| | | |_) | | | | | | |_| | | | | | | |_ | __/ | |
+ |____/ \__,_| |_.__/ |_| |_| \__,_| |_| |_| \__| \___| |_|
+
+
+A fast subdomain takeover tool
+
+Created by Nemesis
+
+Loaded 88 fingerprints for current scan
+
+-----------------------------------------------------------------------------
+
+[+] Nothing found at www.ubereats.com: Not Vulnerable
+[+] Nothing found at testauth.ubereats.com: Not Vulnerable
+[+] Nothing found at apple-maps-app-clip.ubereats.com: Not Vulnerable
+[+] Nothing found at about.ubereats.com: Not Vulnerable
+[+] Nothing found at beta.ubereats.com: Not Vulnerable
+[+] Nothing found at ewp.ubereats.com: Not Vulnerable
+[+] Nothing found at edgetest.ubereats.com: Not Vulnerable
+[+] Nothing found at guest.ubereats.com: Not Vulnerable
+[+] Google Cloud: Possible takeover found at testauth.ubereats.com: Vulnerable
+[+] Nothing found at info.ubereats.com: Not Vulnerable
+[+] Nothing found at learn.ubereats.com: Not Vulnerable
+[+] Nothing found at merchants.ubereats.com: Not Vulnerable
+[+] Nothing found at guest-beta.ubereats.com: Not Vulnerable
+[+] Nothing found at merchant-help.ubereats.com: Not Vulnerable
+[+] Nothing found at merchants-beta.ubereats.com: Not Vulnerable
+[+] Nothing found at merchants-staging.ubereats.com: Not Vulnerable
+[+] Nothing found at messages.ubereats.com: Not Vulnerable
+[+] Nothing found at order.ubereats.com: Not Vulnerable
+[+] Nothing found at restaurants.ubereats.com: Not Vulnerable
+[+] Nothing found at payments.ubereats.com: Not Vulnerable
+[+] Nothing found at static.ubereats.com: Not Vulnerable
+
+Subhunter exiting...
+Results written to test.txt
+
+
+```
+
diff --git a/banner.png b/banner.png
new file mode 100644
index 0000000..d293b4a
Binary files /dev/null and b/banner.png differ
diff --git a/fingerprint.json b/fingerprint.json
new file mode 100644
index 0000000..5ee45e2
--- /dev/null
+++ b/fingerprint.json
@@ -0,0 +1,482 @@
+[
+ {
+ "service": "AWS/Elastic Beanstalk",
+ "cname": ["elasticbeanstalk.com"],
+ "fingerprint": "NXDOMAIN"
+ },
+ {
+ "service": "AWS/S3",
+ "cname": ["s3.amazonaws.com"],
+ "fingerprint": "The specified bucket does not exist"
+ },
+ {
+ "service": "Agile CRM",
+ "cname": ["agilecrm.com"],
+ "fingerprint": "Sorry, this page is no longer available."
+ },
+ {
+ "service": "Airee.ru",
+ "cname": ["airee.ru"],
+ "fingerprint": "Ошибка 402. Сервис Айри.рф не оплачен"
+ },
+ {
+ "service": "Anima",
+ "cname": ["animaapp.io"],
+ "fingerprint": "The page you were looking for does not exist."
+ },
+ {
+ "service": "Bitbucket",
+ "cname": ["bitbucket.io"],
+ "fingerprint": "Repository not found"
+ },
+ {
+ "service": "Campaign Monitor",
+ "cname": [],
+ "fingerprint": "Trying to access your account?"
+ },
+ {
+ "service": "Canny",
+ "cname": [],
+ "fingerprint": "Company Not Found. There is no such company. Did you enter the right URL?"
+ },
+ {
+ "service": "Cargo Collective",
+ "cname": [],
+ "fingerprint": "404 Not Found"
+ },
+ {
+ "service": "Digital Ocean",
+ "cname": [],
+ "fingerprint": "Domain uses DO name servers with no records in DO."
+ },
+ {
+ "service": "Discourse",
+ "cname": ["trydiscourse.com"],
+ "fingerprint": "NXDOMAIN"
+ },
+ {
+ "service": "Gemfury",
+ "cname": ["furyns.com"],
+ "fingerprint": "404: This page could not be found."
+ },
+ {
+ "service": "Getresponse",
+ "cname": [],
+ "fingerprint": "With GetResponse Landing Pages, lead generation has never been easier"
+ },
+ {
+ "service": "Ghost",
+ "cname": ["ghost.io"],
+ "fingerprint": "Site unavailable. Failed to resolve DNS path for this host"
+ },
+ {
+ "service": "HatenaBlog",
+ "cname": ["hatenablog.com"],
+ "fingerprint": "404 Blog is not found"
+ },
+ {
+ "service": "Help Juice",
+ "cname": ["helpjuice.com"],
+ "fingerprint": "We could not find what you're looking for."
+ },
+ {
+ "service": "Help Scout",
+ "cname": ["helpscoutdocs.com"],
+ "fingerprint": "No settings were found for this company:"
+ },
+ {
+ "service": "Helprace",
+ "cname": ["helprace.com"],
+ "fingerprint": "HTTP_STATUS=301"
+ },
+ {
+ "service": "JetBrains",
+ "cname": ["youtrack.cloud"],
+ "fingerprint": "is not a registered InCloud YouTrack"
+ },
+ {
+ "service": "LaunchRock",
+ "cname": ["launchrock.com"],
+ "fingerprint": "HTTP_STATUS=500"
+ },
+ {
+ "service": "Microsoft Azure",
+ "cname": [
+ "cloudapp.net",
+ "cloudapp.azure.com",
+ "azurewebsites.net",
+ "blob.core.windows.net",
+ "cloudapp.azure.com",
+ "azure-api.net",
+ "azurehdinsight.net",
+ "azureedge.net",
+ "azurecontainer.io",
+ "database.windows.net",
+ "azuredatalakestore.net",
+ "search.windows.net",
+ "azurecr.io",
+ "redis.cache.windows.net",
+ "azurehdinsight.net",
+ "servicebus.windows.net",
+ "visualstudio.com"
+ ],
+ "fingerprint": "NXDOMAIN"
+ },
+ {
+ "service": "Ngrok",
+ "cname": ["ngrok.io"],
+ "fingerprint": "Tunnel .*ngrok.io not found"
+ },
+ {
+ "service": "Pantheon",
+ "cname": [],
+ "fingerprint": "404 error unknown site!"
+ },
+ {
+ "service": "Pingdom",
+ "cname": [],
+ "fingerprint": "Sorry, couldn't find the status page"
+ },
+ {
+ "service": "Readme.io",
+ "cname": ["readme.io"],
+ "fingerprint": "The creators of this project are still working on making everything perfect!"
+ },
+ {
+ "service": "Readthedocs",
+ "cname": [],
+ "fingerprint": "The link you have followed or the URL that you entered does not exist."
+ },
+ {
+ "service": "Short.io",
+ "cname": [],
+ "fingerprint": "Link does not exist"
+ },
+ {
+ "service": "SmartJobBoard",
+ "cname": ["52.16.160.97"],
+ "fingerprint": "This job board website is either expired or its domain name is invalid."
+ },
+ {
+ "service": "Smugsmug",
+ "cname": [],
+ "fingerprint": ""
+ },
+ {
+ "service": "Strikingly",
+ "cname": ["s.strikinglydns.com"],
+ "fingerprint": "PAGE NOT FOUND."
+ },
+ {
+ "service": "Surge.sh",
+ "cname": ["na-west1.surge.sh"],
+ "fingerprint": "project not found"
+ },
+ {
+ "service": "SurveySparrow",
+ "cname": ["surveysparrow.com"],
+ "fingerprint": "Account not found."
+ },
+ {
+ "service": "Uberflip",
+ "cname": ["read.uberflip.com"],
+ "fingerprint": "The URL you've accessed does not provide a hub."
+ },
+ {
+ "service": "Uptimerobot",
+ "cname": ["stats.uptimerobot.com"],
+ "fingerprint": "page not found"
+ },
+ {
+ "service": "Wordpress",
+ "cname": ["wordpress.com"],
+ "fingerprint": "Do you want to register .*wordpress.com?"
+ },
+ {
+ "service": "Worksites",
+ "cname": ["worksites.net", "69.164.223.206"],
+ "fingerprint": "Hello! Sorry, but the website you’re looking for doesn’t exist."
+ },
+ {
+ "service": "GitHub",
+ "cname": ["github.io", "github.map.fastly.net"],
+ "fingerprint": [
+ "There isn't a GitHub Pages site here.",
+ "For root URLs (like http://example.com/) you must provide an index.html file"
+ ]
+ },
+ {
+ "service": "Heroku",
+ "cname": ["herokudns.com", "herokussl.com", "herokuapp.com"],
+ "fingerprint": [
+ "There's nothing here, yet.",
+ "herokucdn.com/error-pages/no-such-app.html",
+ "The page you are looking for doesn't exist or has been moved.
"] + }, + { + "service": "Kajabi", + "cname": ["endpoint.mykajabi.com"], + "fingerprint": ["The page you're looking for doesn't exist."] + }, + { + "service": "Aha", + "cname": ["ideas.aha.io"], + "fingerprint": ["There is no portal here ... sending you back to Aha!"] + }, + { + "service": "Brightcove", + "cname": ["brightcovegallery.com", "gallery.video", "bcvp0rtal.com"], + "fingerprint": ["
Error Code: 404
"] + }, + { + "service": "Bigcartel", + "cname": ["bigcartel.com"], + "fingerprint": ["