A simple Python script for basic subdomain enumeration during the reconnaissance phase of penetration testing or bug bounty hunting.
This script attempts to find common subdomains (like admin.example.com, api.example.com, etc.) for a given domain using a pre-defined wordlist. It checks which subdomains are active by sending HTTP requests and logs the discovered ones.
It’s a beginner-friendly tool meant for educational use and learning Python scripting in offensive security.
- Hardcoded wordlist of common subdomains
- Checks for live subdomains via HTTP request
- Saves results into an
output/folder with timestamped logs - Easy to run – no complex setup
$ python subdomain_enum.py example.com