All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- HTTP/HTTPS probing (
subhunt/prober.py) — after enumeration, subhunt can now check which discovered subdomains are actually reachable. Each subdomain is probed over HTTPS first, then HTTP as a fallback. Results carry the final HTTP status code, final URL after redirects, and protocol used. --probeflag — opt-in CLI flag to enable liveness probing after enumeration.--probe-timeout SEC— per-request timeout for each probe attempt (default: 5 s).--probe-workers N— number of parallel probe threads viaThreadPoolExecutor(default: 20), keeping probing fast even for large subdomain sets.--alive-onlyflag — when combined with--probe, only alive subdomains are displayed and exported; dead ones are silently dropped.[200]/[DEAD]badges in terminal output — each subdomain line now shows a colour-coded status badge when probing is enabled: green HTTP status code for alive hosts, red[DEAD]for unreachable ones.- Alive / Dead counts in scan summary — the summary block prints
AliveandDeadcounters when at least one subdomain was probed. - Enriched CSV export — with
--probe, the CSV gains three extra columns:alive(bool),status_code(int),url(final URL after redirects). - Enriched JSON export — with
--probe, the JSON payload includes aprobe_resultsarray with per-subdomain probing details. ScanResult.probe_results— list ofProbeResultobjects, accessible programmatically when using subhunt as a library.ScanResult.alive_count/ScanResult.dead_count— computed properties derived fromprobe_results.ScanConfig.probe,probe_timeout,probe_workers,alive_only— new library API fields to control probing behaviour programmatically.
subhunt.cli:mainregistered as the proper pip entry point (fixesModuleNotFoundErrorwhen runningsubhuntafterpip install).
- RapidDNS source — scrapes
rapiddns.io/subdomain/{domain}?full=1and merges results with crt.sh and HackerTarget automatically. --disable-rapiddnsflag — opt-out of RapidDNS scraping.- 17 new tests in
test_rapiddns.pycovering parsing, error scenarios, rate limiting.
- CLI summary: separate counts for HackerTarget and RapidDNS findings.
ScanConfig: newuse_rapiddns: bool = Truefield.ScanResult: newrapiddns_countfield.- JSON export metadata: added
rapiddns_resultscounter.
- Project renamed
crtsh-recon→subhuntacross package, CLI command,setup.py, logger namespace, and documentation.
- HackerTarget integration (
hackertarget_client.py) — merges results fromapi.hackertarget.com/hostsearch/. - crt.sh health check —
CRTClient.health_check()auto-detects downtime and falls back to HackerTarget. --disable-hackertargetflag.- 23 tests in
test_hackertarget.py;test_scanner.pyfully rewritten (27 tests).
scanner.pyredesigned: health check → crt.sh → HackerTarget → merge → export.ScanConfig: newuse_hackertarget: bool = Truefield.
- Initial release — subdomain enumeration via crt.sh Certificate Transparency logs.
- Modular architecture:
client,parser,validator,exporter,scanner,display,logger. - CLI with argparse, TXT/JSON/CSV export, retry back-off, colorama spinner.
- 117 unit tests, CI matrix (3 OS × 3 Python versions), 80% coverage gate, MIT license.
- DNS resolution for discovered subdomains
- PyPI release (
pip install subhunt)