Subdomain Hunter
Skill Name: subdomain-hunter Version: 1.0.0 Category: Security / Reconnaissance Price: Lifetime: $39 / Optional Monthly: $7/mo (all Pro features permanently) Author: EdgeIQ Labs OpenClaw Compatible: Yes — Python 3, pure stdlib + socket, WSL + Linux
What It Does
Passive subdomain enumeration using Certificate Transparency logs, DNS zone transfer checks, and takeover detection. Reconnaissance-grade discovery without sending active probes.
⚠️ Legal Notice: Only enumerate domains you own or have explicit written permission to audit. Unauthorized recon is illegal.
Features
- Certificate Transparency enumeration — scrape crt.sh for subdomain history
- DNS zone transfer check — attempt AXFR with common NS records
- Takeover detection — identify subdomains pointing to unclaimed/inactive services (CNAME to dead endpoints)
- Common subdomain bruteforce — lightweight wordlist scan for common subdomains
- Subdomain resolution — verify discovered subdomains resolve
- JSON export — structured output for integration
Tier Comparison
| Feature | Free | Pro ($19/mo) | Bundle ($39/mo) |
|---|---|---|---|
| CT log enumeration | ✅ (50 results) | ✅ (unlimited) | ✅ (unlimited) |
| Zone transfer check | ✅ | ✅ | ✅ |
| Takeover detection | — | ✅ | ✅ |
| Bruteforce wordlist | ✅ (2000 names) | ✅ (2000 names) | ✅ (2000 names) |
| JSON export | ✅ | ✅ | ✅ |
| Concurrent resolution | ✅ (50 threads) | ✅ (50 threads) | ✅ (50 threads) |
Installation
cp -r /home/guy/.openclaw/workspace/apps/subdomain-hunter ~/.openclaw/skills/subdomain-hunterUsage
Basic scan (free tier — 50 results)
python3 subdomain_hunter.py --domain example.comPro scan (unlimited + takeover detection)
EDGEIQ_EMAIL=your_email@gmail.com python3 subdomain_hunter.py --domain example.com --proFull bundle scan (bruteforce + concurrent threads)
EDGEIQ_EMAIL=your_email@gmail.com python3 subdomain_hunter.py --domain example.com --bundle --bruteforceExport to JSON
python3 subdomain_hunter.py --domain example.com --output results.jsonCheck for takeovers only
python3 subdomain_hunter.py --domain example.com --takeover-onlyAs OpenClaw Discord Command
In #edgeiq-support channel:
!subdomain example.com
!subdomain example.com --takeover
!subdomain example.com --bruteforceParameters
| Flag | Type | Default | Description |
|---|---|---|---|
--domain | string | — | Target domain |
--pro | flag | False | Enable Pro features |
--bundle | flag | False | Enable Bundle features |
--bruteforce | flag | False | Run common subdomain wordlist |
--takeover | flag | False | Run takeover detection |
--takeover-only | flag | False | Only run takeover detection |
--output | string | — | Write JSON report to file |
--threads | int | 20/50 | Concurrent threads (Pro/Bundle) |
Output Example
=== Subdomain Hunter ===
example.com
CT Entries: 47
Resolved: 31
Dead: 5
Takeovers: 2 🔴
Discovered subdomains:
api.example.com ✅ resolves → 1.2.3.4
staging.example.com ✅ resolves → 1.2.3.5
dev.example.com ❌ DEAD (CNAME to Heroku)
old.example.com 🔴 TAKEOVER (no CNAME, 404)
blog.example.com ✅ resolves → 1.2.3.6
Zone Transfer: BLOCKED
Threat Level: MEDIUMPricing
Lifetime License: $39 — your tool forever, all features included permanently.
Optional Monthly: $7/mo — for those who prefer recurring billing (cancel anytime). 👉 Buy Lifetime — $39 👉 Subscribe Monthly — $7/mo 👉 Subscribe Monthly — $7/mo
Pro Upgrade *(deprecated)*
All features now included in Lifetime purchase.
Support
Open a ticket in #edgeiq-support or email gpalmieri21@gmail.com
🔗 More from EdgeIQ Labs
edgeiqlabs.com — Security tools, OSINT utilities, and micro-SaaS products for developers and security professionals.
- 🛠️ Subdomain Hunter — Passive subdomain enumeration via Certificate Transparency
- 📸 Screenshot API — URL-to-screenshot API for developers
- 🔔 uptime.check — URL uptime monitoring with alerts
- 🛡️ headers.check — HTTP security headers analyzer