{"id":14637806,"url":"https://github.com/GhostTroops/ksubdomain","last_synced_at":"2025-09-07T06:31:13.849Z","repository":{"id":209299420,"uuid":"723428602","full_name":"GhostTroops/ksubdomain","owner":"GhostTroops","description":"子域名爆破，增加了智能爬虫功能","archived":false,"fork":false,"pushed_at":"2024-03-22T07:53:14.000Z","size":33816,"stargazers_count":62,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-02T10:37:47.749Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GhostTroops.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-25T16:30:14.000Z","updated_at":"2024-12-25T00:55:23.000Z","dependencies_parsed_at":"2024-06-19T17:36:37.006Z","dependency_job_id":"aef42721-bebb-4a24-a80b-f619d3ae1c56","html_url":"https://github.com/GhostTroops/ksubdomain","commit_stats":{"total_commits":137,"total_committers":4,"mean_commits":34.25,"dds":0.656934306569343,"last_synced_commit":"8988d9f0bd62c7c3cadd7756bc63a42afe41bfa1"},"previous_names":["hktalent/ksubdomain"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/GhostTroops/ksubdomain","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostTroops%2Fksubdomain","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostTroops%2Fksubdomain/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostTroops%2Fksubdomain/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostTroops%2Fksubdomain/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GhostTroops","download_url":"https://codeload.github.com/GhostTroops/ksubdomain/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostTroops%2Fksubdomain/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274005341,"owners_count":25205934,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-07T02:00:09.463Z","response_time":67,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-10T02:01:16.506Z","updated_at":"2025-09-07T06:31:08.801Z","avatar_url":"https://github.com/GhostTroops.png","language":"Go","funding_links":["https://www.paypal.me/pwned2019"],"categories":["Go"],"sub_categories":[],"readme":"[![Twitter](https://img.shields.io/twitter/url/http/Hktalent3135773.svg?style=social)](https://twitter.com/intent/follow?screen_name=Hktalent3135773) [![Follow on Twitter](https://img.shields.io/twitter/follow/Hktalent3135773.svg?style=social\u0026label=Follow)](https://twitter.com/intent/follow?screen_name=Hktalent3135773) [![GitHub Followers](https://img.shields.io/github/followers/hktalent.svg?style=social\u0026label=Follow)](https://github.com/hktalent/)\n[![Top Langs](https://profile-counter.glitch.me/hktalent/count.svg)](https://51pwn.com)\n\n(该仓库为二次集成开发、分布式、多任务而重构)\n\u003cimg width=\"851\" alt=\"Screenshot 2023-01-13 at 19 13 58\" src=\"https://user-images.githubusercontent.com/18223385/212307600-97a84f14-4660-4ad6-a835-7811f6dcd87d.png\"\u003e\n（VIP user https://51pwn.com）\n## 特性和Tips\n- 2023-11-20\n   * 支持 【* 前缀,*.hackerone.com】，或者 * 在中间的情况\n   * 支持 【后缀 *,hackerone.*】，共计 9744 种后缀，所以非必要，不建议 * 后缀，否则将超过 298 亿次迭代\n   * 支持 【中间 *,www.paypal-*.com】\n- 2023-04-03\n   * 合并 https://codeload.github.com/n0kovo/n0kovo_subdomains/zip/refs/heads/main 字典到 config/subdomain.txt,并优化其中无效数据\n   * 字典数量 累计 3065536 【306万+】个\n- 2023-01-13\n    * 增加结果自动记录大数据搜索引擎(config/config.json)\n    * 所有异步优化到可控线程池\n    * 增加字典 -f 默认字典 config/subdomain.txt，包含了 data 下两个字典的合并、去重\n    * 优化内存开销，降低到600M内，修复原来版本内存泄漏的bug--原版扫描结果超过200万后内存泄漏到 \u003e 30G\n  \n![](image.gif)\n## 安装\n1. 下载二进制 https://github.com/hktalent/ksubdomain/releases\n2. 安装libpcap环境\n   - Windows\n     下载`npcap`驱动，winpcap驱动有人反馈无效\n   - Linux\n     已经静态编译打包libpcap，无需其他操作\n   - MacOS\n     自带 libpcap,无需其他操作\n3. 执行!\n### 快速安装\n需要`go 1.21.3`以上版本并安装`libpcap`环境，运行以下命令\n```\ngo install -v github.com/hktalent/ksubdomain/cmd/ksubdomain@latest\n```\n## Usage\n```bash\nNAME:\n   KSubdomain - 无状态子域名爆破工具\n\nUSAGE:\n   ksubdomain [global options] command [command options] [arguments...]\n\nVERSION:\n   1.8.6\n\nCOMMANDS:\n   enum, e    枚举域名\n   verify, v  验证模式\n   test       测试本地网卡的最大发送速度\n   help, h    Shows a list of commands or help for one command\n\nGLOBAL OPTIONS:\n   --help, -h     show help (default: false)\n   --version, -v  print the version (default: false)\n\n```\n\n## 一种用法\nlist.txt\n内容如下，表示需要对下面的列表后缀进行遍历\n```\ncom\nedu\ngov\nedu.cn\ngov.cn\n```\n命令,设定500M带宽，输出为json\n需要特别注意的是，看上去成功数为几百万，实际得到有效的会更少，因为有的域名返回的ip是\"0.0.0.1\"，在结果中直接过滤掉了\n```\ncat  list.txt|./ksubdomain e -stdin --band 500m -o list_All.json -json \n```\nother\n```\ncat $HOME/MyWork/bug-bounty/data/hk1/hk1.txt|./ksubdomain e -stdin --band 500m -o hk1.json -json\ncat \u003c\u003cEOT\u003e/usr/local/bin/doSubdomain\nxx=`pwd`\ncd $HOME/MyWork/ksubdomain\nCNum=1000000\n./ksubdomain e -d $1 --band 500m -o $1.json -json -l 2\nmv $1.txt $xx/\n\nEOT\nchmod +x /usr/local/bin/doSubdomain\n```\n### 模式\n\n**验证模式**\n提供完整的域名列表，ksubdomain负责快速获取结果\n\n```bash\n./ksubdomain verify -h\n\nNAME:\n   ksubdomain verify - 验证模式\n\nUSAGE:\n   ksubdomain verify [command options] [arguments...]\n\nOPTIONS:\n   --filename value, -f value   验证域名文件路径\n   --band value, -b value       宽带的下行速度，可以5M,5K,5G (default: \"2m\")\n   --resolvers value, -r value  dns服务器文件路径，一行一个dns地址\n   --output value, -o value     输出文件名\n   --silent                     使用后屏幕将仅输出域名 (default: false)\n   --retry value                重试次数,当为-1时将一直重试 (default: 3)\n   --timeout value              超时时间 (default: 6)\n   --stdin                      接受stdin输入 (default: false)\n   --only-domain, --od          只打印域名，不显示ip (default: false)\n   --not-print, --np            不打印域名结果 (default: false)\n   --dns-type value             dns类型 1为a记录 2为ns记录 5为cname记录 16为txt (default: 1)\n   --help, -h                   show help (default: false)\n```\n\n```\n从文件读取 \n./ksubdomain v -f dict.txt\n\n从stdin读取\necho \"www.hacking8.com\"|./ksubdomain v --stdin\n\n读取ns记录\necho \"hacking8.com\" | ./ksubdomain v --stdin --dns-type 2\n```\n\n**枚举模式**\n只提供一级域名，指定域名字典或使用ksubdomain内置字典，枚举所有二级域名\n\n```bash\n./ksubdomain enum -h\n\nNAME:\n   ksubdomain enum - 枚举域名\n\nUSAGE:\n   ksubdomain enum [command options] [arguments...]\n\nOPTIONS:\n   --band value, -b value          宽带的下行速度，可以5M,5K,5G (default: \"2m\")\n   --resolvers value, -r value     dns服务器文件路径，一行一个dns地址\n   --output value, -o value        输出文件名\n   --silent                        使用后屏幕将仅输出域名 (default: false)\n   --retry value                   重试次数,当为-1时将一直重试 (default: 3)\n   --timeout value                 超时时间 (default: 6)\n   --stdin                         接受stdin输入 (default: false)\n   --only-domain, --od             只打印域名，不显示ip (default: false)\n   --not-print, --np               不打印域名结果 (default: false)\n   --dns-type value                dns类型 1为a记录 2为ns记录 5为cname记录 16为txt (default: 1)\n   --domain value, -d value        爆破的域名\n   --domainList value, --dl value  从文件中指定域名\n   --filename value, -f value      字典路径\n   --skip-wild                     跳过泛解析域名 (default: false)\n   --level value, -l value         枚举几级域名，默认为2，二级域名 (default: 2)\n   --level-dict value, --ld value  枚举多级域名的字典文件，当level大于2时候使用，不填则会默认\n   --help, -h                      show help (default: false)\n```\n\n```\n./ksubdomain e -d baidu.com\n\n从stdin获取\necho \"baidu.com\"|./ksubdomain e --stdin\n```\n\n# How ...\n- pcap打开失败:enxx: You don't have permission to capture on that device ((cannot open BPF device) /dev/bpf0: Permission denied)\n```\ngo build -o ksubdomain main.go;cp ksubdomain ~/go/bin/ \nsudo chgrp staff /dev/bpf*\ncat $HOME/MyWork/bounty-targets-data/data/hackerone_data.json|jq \".[].targets.in_scope[0].asset_identifier\"|grep -v 'null'\ncat $HOME/MyWork/bounty-targets-data/data/hackerone_data.json|jq \".[].targets.in_scope[0].asset_identifier\"|grep '\"\\*\\.'|sed 's/\"//g'|sed 's/^\\*\\.//g' \u003elists.txt\necho $PPSSWWDD| sudo -S ./ksubdomain enum -b 5M --dl lists.txt -f $HOME/MyWork/scan4all/config/database/subdomain.txt\n```\n\n## 特性和Tips\n- 无状态爆破，有失败重发机制，速度极快\n- 中文帮助，-h会看到中文帮助\n- 两种模式，枚举模式和验证模式，枚举模式内置10w字典\n- 将网络参数简化为了-b参数，输入你的网络下载速度如-b 5m，将会自动限制网卡发包速度。\n- 可以使用./ksubdomain test来测试本地最大发包数\n- 获取网卡改为了全自动并可以根据配置文件读取。\n- 会有一个时时的进度条，依次显示成功/发送/队列/接收/失败/耗时 信息。\n- 不同规模的数据，调整 --retry --timeout参数即可获得最优效果\n- 当--retry为-1，将会一直重试直到所有成功。\n- 支持爆破ns记录\n\n## 与massdns、dnsx对比\n\n使用100w字典，在4H5M的网络环境下测试\n\n|          | ksubdomain                                                   | massdns                                                      | dnsx                                                         |\n| -------- | ------------------------------------------------------------ | ------------------------------------------------------------ | ------------------------------------------------------------ |\n| 支持系统 | Windows/Linux/Darwin                                         | Windows/Linux/Darwin                                         | Windows/Linux/Darwin                                         |\n| 功能 | 支持验证和枚举 | 只能验证 | 只能验证 |\n| 发包方式 | pcap网卡发包                                                 | epoll,pcap,socket                                            | socket                                                       |\n| 命令行 | time ./ksubdomain v -b 5m -f d2.txt -o ksubdomain.txt -r dns.txt --retry 3 --np | time ./massdns -r dns.txt -t AAAA -w massdns.txt d2.txt --root -o L | time ./dnsx -a -o dnsx.txt -r dns.txt -l d2.txt -retry 3 -t 5000 |\n| 备注   | 加了--np 防止打印过多                                        |                                                              |                                                              |\n| 结果   | 耗时:1m28.273s\u003cbr /\u003e成功个数:1397                            | 耗时:3m29.337s\u003cbr /\u003e成功个数:1396                            | 耗时:5m26.780s \u003cbr /\u003e成功个数:1396                           |\n\nksubdomain只需要1分半，速度远远比massdns、dnsx快~\n\n## 参考\n\n- 原ksubdomain https://github.com/knownsec/ksubdomain\n- 从 Masscan, Zmap 源码分析到开发实践 \u003chttps://paper.seebug.org/1052/\u003e\n- ksubdomain 无状态域名爆破工具介绍 \u003chttps://paper.seebug.org/1325/\u003e\n- [ksubdomain与massdns的对比](https://mp.weixin.qq.com/s?__biz=MzU2NzcwNTY3Mg==\u0026mid=2247484471\u0026idx=1\u0026sn=322d5db2d11363cd2392d7bd29c679f1\u0026chksm=fc986d10cbefe406f4bda22f62a16f08c71f31c241024fc82ecbb8e41c9c7188cfbd71276b81\u0026token=76024279\u0026lang=zh_CN#rd) \n\n\n# Communication group (WeChat, QQ，Tg)\n|Wechat|Or|QQchat|Or|Tg|\n|---|---|---|--- |--- |\n| \u003cimg width=166 src=https://github.com/hktalent/scan4all/blob/main/static/wcq.JPG\u003e || \u003cimg width=166 src=https://github.com/hktalent/scan4all/blob/main/static/qqc.jpg\u003e || \u003cimg width=166 src=https://github.com/hktalent/scan4all/blob/main/static/tg.jpg\u003e |\n\n\n## 💖Star\n[![Stargazers over time](https://starchart.cc/hktalent/ksubdomain.svg)](https://starchart.cc/hktalent/ksubdomain)\n\n# Donation\n| Wechat Pay | AliPay | Paypal | BTC Pay |BCH Pay |\n| --- | --- | --- | --- | --- |\n|\u003cimg src=https://raw.githubusercontent.com/hktalent/myhktools/main/md/wc.png\u003e|\u003cimg width=166 src=https://raw.githubusercontent.com/hktalent/myhktools/main/md/zfb.png\u003e|[paypal](https://www.paypal.me/pwned2019) **miracletalent@gmail.com**|\u003cimg width=166 src=https://raw.githubusercontent.com/hktalent/myhktools/main/md/BTC.png\u003e|\u003cimg width=166 src=https://raw.githubusercontent.com/hktalent/myhktools/main/md/BCH.jpg\u003e|\n\n\u003c!--\ncat $HOME/MyWork/bug-bounty/data/bounty-targets-data/data/hackerone_data.json|jq '.[].targets.in_scope[].asset_identifier'|grep -E '\\*|https:\\/\\/'|grep -E \"\\*\\.\"|tr ', ' '\\n'|tr -d '\"' |sort -u|sed -E 's/http(s)?:\\/\\/\\*/\\*/g' |sed -E 's/\\/.*$|\\*$//g'\u003e$HOME/MyWork/ksubdomain/hk1.txt\n\n\n--\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGhostTroops%2Fksubdomain","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FGhostTroops%2Fksubdomain","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FGhostTroops%2Fksubdomain/lists"}