Security Cipher
Home Blog About Us
Resources β–Ό
πŸ—ΊοΈ Penetration Testing Roadmap 🌐 Web Application Security Checklist πŸ€– OWASP Top 10 for LLM Applications 🧠 LLM AI Security Checklist πŸ› οΈ Security Tools 🎯 Penetration Testing Tricks πŸ“„ Secure Code Explain πŸ“– Vulnerability Explain ☁️ AWS Cloud Security Checklist
My Resume
Contact Us
← Security Tools View on GitHub

github-subdomains

Finds subdomains for a target by mining GitHub code search results.

github-subdomains

Find subdomains on GitHub.

go badge MIT license badge twitter badge


Description

This Go tool performs searches on GitHub and parses the results to find subdomains of a given domain.

Install

go install github.com/gwen001/github-subdomains@latest

or

git clone https://github.com/gwen001/github-subdomains
cd github-subdomains
go install

Usage

$ github-subdomains -h

Usage of github-subdomains:
  -d string
    	domain you are looking for (required)
  -e	extended mode, also look for <dummy>example.<tld>
  -k	exit the program when all tokens have been disabled
  -o string
    	output file, default: <domain>.txt
  -raw
    	raw output
  -t string
    	github token (required), can be:
    	  β€’ a single token
    	  β€’ a list of tokens separated by comma
    	  β€’ a file (.tokens) containing 1 token per line
    	if the options is not provided, the environment variable GITHUB_TOKEN is readed, it can be:
    	  β€’ a single token
    	  β€’ a list of tokens separated by comma

If you want to use multiple tokens, you better create a .tokens file in the executable directory with 1 token per line

token1
token2
...

or use an environment variable with tokens separated by comma:

export GITHUB_TOKEN=token1,token2...

Tokens are disabled when GitHub raises a rate limit alert, however they are re-enable 1mn later. You can disable that feature by using the option -k.

Todo

  • change the order of the extra searches ?
  • ?

Changelog

20/09/2022

  • fix regexp for subdomains

25/09/2020

  • quick mode added
  • tokens can be read from any file

23/09/2020

  • fixed an issue in the api call (params name)
  • added binary

12/08/2020

  • improved clean function

06/08/2020

  • max_page set forced to 10 to save 1 request for every search
  • new banner (easier to maintain)
  • removed _ from the regexps
  • extended regexp fixed
  • improved cleaning function

05/08/2020

  • added an option to exit the program when all tokens have been disabled instead of waiting
  • rate limited tokens are disabled for 1mn then re-enabled
  • removed options for languages and noise
  • better page management
  • panic errors handled

04/08/2020

  • moved default languages and noise to source code
  • added an option for languages and noise
  • bug fixed in searches with language and noise (empty keyword)
  • added search signature to avoid duplicate searches with noise
  • file loading rewritten
  • preview image added

03/08/2020

  • fixed delay changed 100 -> 200
  • removed useless debug messages

Feel free to open an issue if you have any problem with the script.

Press Escape to close the search panel.

Donate

Buy me a Coffee

Penetration Testing Services - Fiverr

Buy me a Coffee

Penetration Testing Services

penetration Testing Services

Web Application Security Quiz

Web Application Security Quiz

Daily Bug Bounty Writeups - Twitter

Daily Bug Bounty Writeups

Download our Latest Android Application

Guide for Penetration Testing

Daily Bug Bounty Writeups - Telegram

Daily Bug Bounty Writeups

Author

Piyush
Senior Product Security Engineer

Ethical Hacker || Penetration Tester || Gamer || Blogger || Application Security Engineer

READ ARTICLE

Donate

Buy me a Coffee

Recent Posts

  • Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
    Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
    July 19, 2026/
    0 Comments
  • Is AI Killing Bug Bounty? What the 2026 CVE Flood Really Means for Hunters
    Is AI Killing Bug Bounty? What the 2026 CVE Flood Really Means for Hunters
    July 17, 2026/
    0 Comments
  • AI Pentest Tools in 2026: What Actually Works (T3MP3ST, PentestGPT, Caido and More)
    AI Pentest Tools in 2026: What Actually Works (T3MP3ST, PentestGPT, Caido and More)
    July 16, 2026/
    0 Comments

Follow Us

SecurityCipher

Practical security guides, vulnerability deep-dives, and hands-on resources for bug bounty hunters and penetration testers.

Useful Links

  • Blogs
  • About
  • Contact

Recent Post

  • Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
  • Is AI Killing Bug Bounty? What the 2026 CVE Flood Really Means for Hunters
  • AI Pentest Tools in 2026: What Actually Works (T3MP3ST, PentestGPT, Caido and More)
Β© 2026 SecurityCipher. All rights reserved. Privacy Policies Β· Terms & Conditions