> For the complete documentation index, see [llms.txt](https://shohamshilo.gitbook.io/shohamshilo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://shohamshilo.gitbook.io/shohamshilo/projects-and-tools/subbuster.md).

# SubBuster — Subdomain Discovery

> 🐙 **Repo:** [github.com/shoamshilo/SubBuster](https://github.com/shoamshilo/SubBuster) · **Language:** Python

## What it does

SubBuster is a Python tool for discovering subdomains of a target during the reconnaissance phase of a web assessment or bug-bounty engagement. Broad, accurate subdomain discovery is one of the highest-leverage things you can do early the more of an organization's attack surface you can map, the more likely you are to find the soft spot.

## How it fits my workflow

```
Target scope ──► SubBuster ──► live subdomains ──► port/service enum (Nmap) ──► content discovery
```

The output feeds straight into active enumeration and, often, into [recon-os](/shohamshilo/projects-and-tools/recon-os.md) for the next steps.

## What I learned

* DNS internals record types, resolution behavior, and how wildcard DNS can poison naive enumeration.
* Handling rate limits and being a polite consumer of public data sources.
* Writing tooling that's resumable and produces clean, machine-readable output for the next tool in the chain.

## Responsible use

only perform discovery against targets you're authorized to test.

***

➡️ Next tool: [recon-os](/shohamshilo/projects-and-tools/recon-os.md)