{"id":26791946,"url":"https://github.com/sam-lane/subway","last_synced_at":"2026-05-04T02:31:07.004Z","repository":{"id":57569120,"uuid":"262765389","full_name":"Sam-Lane/subway","owner":"Sam-Lane","description":"Another subdomain enumeration tool","archived":false,"fork":false,"pushed_at":"2020-08-18T07:54:50.000Z","size":3,"stargazers_count":6,"open_issues_count":1,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-06-21T14:04:30.994Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Sam-Lane.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-05-10T10:47:10.000Z","updated_at":"2023-11-25T04:30:40.000Z","dependencies_parsed_at":"2022-08-23T17:31:31.048Z","dependency_job_id":null,"html_url":"https://github.com/Sam-Lane/subway","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sam-Lane%2Fsubway","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sam-Lane%2Fsubway/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sam-Lane%2Fsubway/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sam-Lane%2Fsubway/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Sam-Lane","download_url":"https://codeload.github.com/Sam-Lane/subway/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246200294,"owners_count":20739568,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-03-29T15:18:54.394Z","updated_at":"2026-05-04T02:31:06.949Z","avatar_url":"https://github.com/Sam-Lane.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003e🥪 SUBway \u003c/h1\u003e\n\u003cp align=\"center\"\u003eAnother subdomain enumberation tool\u003c/p\u003e\n\n\nEnumerate subdomains by either using DNS lookup or by virtual hosting HTTP requests, useful for things like [Hack The Box](https://www.hackthebox.eu) or [Try Hack Me](https://tryhackme.com/). SUBway requires a wordlist to use for subdomain discovery, [SecLists](https://github.com/danielmiessler/SecLists) is the recomended pairing for use with this tool.\n\n\n## Usage\n```\nDNS lookup\nsubway -h example.com -w subdomains.txt\n\nVirtual hosts:\nsubway -h example.com -w subdomains.txt -v -ip 127.0.0.1\n\n-h string\n        base apex domain to enumerate against, eg: example.com\n-hc string\n        Hide responses that contain character length, eg: 2000,20043\n-hs string\n        Ignore status codes, eg: 302,301,401. Status 404 is always ignored\n-ip string\n        IP used for virtual hosting (REQUIRED), eg: 127.0.0.1\n-v    enumerate subdomains by virtual hosts instead of DNS lookup\n-w string\n        path to wordlist to use, eg: /usr/share/subdomains.txt\n```\n\n## Examples\n\n### DNS look up\n```\nsubway -h example.com -w subdomains.txt\n====================================\n   ______  _____                  \n  / __/ / / / _ )_    _____ ___ __\n _\\ \\/ /_/ / _  | |/|/ / _ '/ // /\n/___/\\____/____/|__,__/\\_,_/\\_, / \n                           /___/  \n====================================\n\nhost: example.com\nwordlist: subdomains.txt\n====================================\nwww.example.com\nwild.example.com\nmail.example.com\nserver.example.com\ndev1.example.com\n100:100\ndone\n```\n\n### Virtual hosting look up\nWhen looking by virtual hosts you get additional information such as the status code of the response and the content length.\n```\nsubway -h example.com -w subdomains.txt -v -ip 127.0.0.1\n====================================\n   ______  _____                  \n  / __/ / / / _ )_    _____ ___ __\n _\\ \\/ /_/ / _  | |/|/ / _ '/ // /\n/___/\\____/____/|__,__/\\_,_/\\_, / \n                           /___/  \n====================================\n\nhost: example.com\nwordlist: subdomains.txt\n====================================\n200 388178  www.example.com\n200 388178  wild.example.com\n200 11720  mail.example.com\n302 186015  server.example.com\n401 4438  dev1.example.com\n100:100\ndone\n```\n\n##### Filter out status codes\nLets filter out any responses that contain a 302 and a 401\n```\nsubway -h example.com -w subdomains.txt -v -ip 127.0.0.1 -hs 302,401\n====================================\n   ______  _____                  \n  / __/ / / / _ )_    _____ ___ __\n _\\ \\/ /_/ / _  | |/|/ / _ '/ // /\n/___/\\____/____/|__,__/\\_,_/\\_, / \n                           /___/  \n====================================\n\nhost: example.com\nwordlist: subdomains.txt\nignore status: 401,302\n====================================\n200 388178  www.example.com\n200 388178  wild.example.com\n200 11720  mail.example.com\n100:100\ndone\n```\n\n##### Filter out content lengths\nLets filter out any responses that contain a content-length. This is useful for where a wild card subdomain has been setup to redirect to the base domain.\nPreviously www.example.com and wild.example.com both direct to the same site and have the same content-length. Lets filter this out any repsonse with content length `388178`.\n```\nsubway -h example.com -w subdomains.txt -v -ip 127.0.0.1 -wc 388178\n====================================\n   ______  _____                  \n  / __/ / / / _ )_    _____ ___ __\n _\\ \\/ /_/ / _  | |/|/ / _ '/ // /\n/___/\\____/____/|__,__/\\_,_/\\_, / \n                           /___/  \n====================================\n\nhost: example.com\nwordlist: subdomains.txt\nignore content length: 388178\n====================================\n200 11720  mail.example.com\n302 186015  server.example.com\n401 4438  dev1.example.com\n100:100\ndone\n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsam-lane%2Fsubway","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsam-lane%2Fsubway","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsam-lane%2Fsubway/lists"}