# SDomDiscover | A Easy-To-Use Python Tool To Perform DNS Recon

**URL:** <https://onehack.st/t/sdomdiscover-a-easy-to-use-python-tool-to-perform-dns-recon/223973>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies, hosting\
**Created:** [September 16, 2022, 8:58pm UTC](https://onehack.st/t/sdomdiscover-a-easy-to-use-python-tool-to-perform-dns-recon/223973 "2022-09-16T20:58:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\
**Post date:** [September 16, 2022, 8:58pm UTC](https://onehack.st/t/sdomdiscover-a-easy-to-use-python-tool-to-perform-dns-recon/223973/1 "2022-09-16T20:58:38Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/2/d/2d14b6820f84cd9fab172639126ceb102149f083.png)

# All in One Recon Tool

`An easy-to-use python tool to perform dns recon, subdomain enumeration and much more`

The purpouse of this tool is helping bug hunters and pentesters during reconnaissance

If you want to know more about the tool you can read my own [post](https://d3ext.github.io/aort) in my blog (written in spanish)

## Installation:

It can be used in any system with python3

You can easily install AORT using pip:

pip3 install aort

If you want to install it from source:

git clone [https://github.com/D3Ext/AORT](https://github.com/D3Ext/AORT) cd AORT pip3 install -r requirements.txt

> One-liner

git clone [https://github.com/D3Ext/AORT](https://github.com/D3Ext/AORT) && cd AORT && pip3 install -r requirements.txt && python3 AORT.py

## Usage:

- Common usages

> If installed with pip3:

aort

> To see the help panel and other parameters

python3 AORT.py -h

> Main usage of the tool to dump the valid domains

python3 AORT.py -d [example.com](http://example.com)

> Perform all the recon

python3 AORT.py -d [domain.com](http://domain.com) --all

## Features:

☑ Enumerate subdomains using passive techniques (like **subfinder** )

☑ A lot of extra queries to enumerate the DNS

☑ Domain Zone transfer attack

☑ WAF type detection

☑ Subdomain Takeover checker

☑ Scan common ports

☑ Check active subdomains (like **httprobe** )

☑ Wayback machine support to enumerate endpoints (like **waybackurls** )

☑ Email harvesting

## Demo:

> Simple query to find valid subdomains

[![](https://raw.githubusercontent.com/D3Ext/AORT/main/demo.png)](https://raw.githubusercontent.com/D3Ext/AORT/main/demo.png)

## Third part

The tool uses different services to get subdomains in different ways

The WAF detector was modified and addapted from [CRLFSuite](https://github.com/Nefcore/CRLFsuite) concept

All DNS queries are scripted in python at 100%

Email harvesting using Proxycrawl API with personal token (you can register a free account with 100 uses)

## GitHub:

[https://github.com/D3Ext/AORT](https://github.com/D3Ext/AORT)