Subrecon

I built subrecon — a command-line tool that automates the subdomain recon workflow most pen testers and bug bounty hunters run manually every day.

the problem

Subdomain enumeration is one of the first steps in any external engagement. The workflow is always the same: discover subdomains, resolve DNS, probe for live web servers, filter the noise. Most people chain together 3-4 tools with a bash one-liner or a personal script that breaks whenever something updates. I wanted something cleaner.

what it does

subrecon takes a domain and runs the full pipeline in one command:

subrecon example.com

[1/3] Enumerating subdomains...
      22253 unique → subs.txt
[2/3] Resolving DNS...
      9 resolved → resolved.txt
[3/3] Probing for live hosts...
      3 live → live.txt
[4/4] Filtered [200] → 3 URL(s) → live-200.txt

[✓] Results in outputs/example.com/

22,253 subdomains in. 3 live targets out. That is the whole point — cut through the noise and give you what is actually reachable.

Under the hood it chains together assetfinder, subfinder, dnsx, and httpx. Multiple enumeration sources for better coverage, DNS resolution to confirm they exist, HTTP probing to find live servers, and a built-in filter to keep only the status codes you care about.

how to use it

git clone https://github.com/t3lesph0re/subrecon.git
cd subrecon
pipx install .

Then from anywhere:

subrecon target.com                  # basic run
subrecon target.com -v               # verbose
subrecon target.com -s 200,301,403   # keep multiple status codes
subrecon clean outputs/target.com    # cleanup

Full setup instructions and required dependencies are in the README.

why build it

I got tired of copy-pasting the same chain of commands at the start of every engagement. This also gave me a reason to learn how to structure a Python tool properly — pip-installable with a real CLI entry point instead of loose scripts.

Yes, AI helped me build it. I am not going to pretend otherwise. But every line was reviewed, tested against real targets, and refined based on what actually works in the field. The tool does what I need it to do, and if it helps someone else move faster during recon, even better.

Check it out: github.com/t3lesph0re/subrecon