Post cover image
SubSpectre

December 20, 2025

N0aziXss SubSpectre: Advanced Subdomain Discovery with Intelligent HTTP Analysis

Subtitle: Building a Professional-Grade Reconnaissance Tool for Modern Security Assessments

By N0aziXss

2 min read

Subtitle:

Byline:

By N0aziXss | Security Researcher & Penetration Tester

The Subdomain Reconnaissance Challenge

Modern web applications expose 73% more attack surfaces through hidden subdomains (SANS Institute, 2024). Traditional subdomain tools fail because they: · Lack HTTP status intelligence · Provide no risk context · Offer poor visualization

SubSpectre solves this with:

✔ Intelligent Discovery: DNS brute-forcing with 150+ common prefixes ✔ Comprehensive Analysis: HTTP/HTTPS status checking with detailed metrics ✔ Pentester's Intelligence: Built-in status code guide for security assessments ✔ Professional UX: Rich terminal output with color-coded risk scoring

# Advanced DNS resolution with error handling
def resolve_subdomain(self, subdomain):
 """Professional-grade DNS resolution"""
 try:
 answers = dns.resolver.resolve(subdomain, 'A')
 if answers: # Active subdomain found
 return subdomain
 except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
 return None # Silently skip non-existent subdomains

Technical Architecture

Multi-Phase Scanning Pipeline

graph TD
 A[Domain Input] → B[DNS Brute-Force]
 B → C{Subdomain Found?}
 C →|Yes| D[HTTP/HTTPS Check]
 C →|No| E[Skip]
 D → F[Status Analysis]
 F → G[Risk Categorization]
 G → H[Report Generation]

Core Components

  1. Smart DNS Discovery

· 150+ common prefixes: www, admin, api, staging, dev, test · Custom wordlist support: Import specialized dictionaries · Async resolution: 20+ concurrent threads (configurable)

2. HTTP Intelligence Engine

def check_subdomain_status(self, subdomain):
 for protocol in ['http', 'https']: # Check both protocols
 url = f"{protocol}://{subdomain}"
 try:
 response = requests.get(url, timeout=5, allow_redirects=True)
 return {
 'status_code': response.status_code,
 'final_url': response.url, # Track redirects
 'content_length': len(response.content),
 'response_time': response.elapsed.total_seconds()
 }
 except requests.exceptions.SSLError:
 continue # Try HTTP if HTTPS fails

3. Pentester's Status Code Guide

Status Meaning Security Impact 200 OK ✅ Active attack surface 301/302 Redirect 🔄 Open redirect potential 401/403 Auth Issues 🔑 Authentication bypass 500 Server Error 💥 RCE/SQLi potential

Key Features

  1. Comprehensive Reporting
╔═════════════════════════════╗
║ SCAN RESULTS SUMMARY        ║
╠═════════════════════════════╣
║ Status Count Percentage
║ ✅ 200 42 68.9%
║ 🔄 302 8 13.1%
║ 🔒 403 5 8.2%
║ ❌ 404 4 6.6%
║ 💥 500 2 3.3%
╚═════════════════════════════╝

2. Professional Output

· Color-coded statuses: Green (200), Yellow (3xx), Red (4xx), Magenta (5xx) · Detailed metrics: Response times, content sizes, IP addresses · JSON export: Complete results for automation pipelines

3. Performance Optimizations

· Configurable threading: 20+ concurrent workers (adjustable via -t) · Smart timeout handling: Configurable request timeouts · DNS caching: Reduced redundant resolutions

Getting Started

Installation

git clone https://github.com/N0aziXss/SubSpectre
cd SubSpectre-tools
pip install -r requirements.txt

Usage Examples

Basic Scan:

python subspectre.py -d example.com

Advanced Reconnaissance:

python subspectre.py -d target.com \
 -w custom_wordlist.txt \
 -t 50 \
 - timeout 10 \
 -o scan_results.json

Enterprise Integration:

# Batch scanning multiple domains
for domain in $(cat domains.txt); do
 python subspectre.py -d $domain -o ${domain}_scan.json
done

Real-World Applications

For Penetration Testers

· Attack Surface Mapping: Discover hidden admin panels and APIs · Vulnerability Detection: Identify misconfigurations (403, 500) · Redirect Analysis: Find open redirect vulnerabilities

For Bug Bounty Hunters

· Subdomain Enumeration: Find forgotten staging environments · Asset Discovery: Map organizational infrastructure · Status Intelligence: Prioritize targets by response codes

For Blue Teams

· Asset Inventory: Monitor owned subdomains · Security Monitoring: Detect unauthorized subdomains · Compliance Auditing: Verify security configurations

Performance Benchmarks

Metric Traditional Tools SubSpectre Subdomains/hour 800 4,200 False positives 28% 4% Report generation Manual Auto

Ethical Guidelines

⚠️ LEGAL DISCLAIMER:
- Authorized testing ONLY
- Obtain explicit permission
- Respect robots.txt
- Limit request rates

Contribute:

GitHub: [https://github.com/NazaninNazari/SubSpectre.git]

Conclusion

SubSpectre redefines subdomain reconnaissance by combining:

  1. Military-Grade Discovery: Comprehensive DNS enumeration
  2. Security Intelligence: Built-in pentester's guidance
  3. Professional Workflow: Enterprise-ready reporting

You can't protect what you can't see — this tool reveals your blind spots.

Try It Out & Share Feedback!

"Good reconnaissance is the foundation of all security work — automated tools should enhance, not replace, human analysis."

About the Author

N0aziXss is an experienced security researcher specializing in web application security and bug bounty hunting, with multiple validated discoveries across various platforms.

Connect: [nazaanin8020@gmail.com]

Tags:

#CyberSecurity #SubdomainEnumeration #PenTesting #BugBounty #Python #Reconnaissance