As a cybersecurity professional, bug bounty hunter, or penetration tester, discovering hidden subdomains is critical for identifying potential vulnerabilities in a domain. Subdomains often host forgotten services or test environments that might be vulnerable to attacks.

In this post, I’ll introduce you to SubDomainRadar.io and its Python API wrapper — the ultimate tool for automating subdomain enumeration and reverse searches in your security workflows.

Why SubDomainRadar.io?

SubDomainRadar.io stands out because it uses over 40 private data sources to deliver a comprehensive subdomain discovery experience. Whether you need to run fast, deep, or reverse searches, this tool will help you find more subdomains than ever before.

Plus, with the SubDomainRadar Python library, you can easily integrate these powerful capabilities into your own projects and scripts.

Features of the Python Wrapper

With the SubDomainRadar Python API wrapper, you can:

• Perform reverse searches on subdomains based on keywords
• Enumerate domains with varying search depth (Fast, Medium, Deep)
• Retrieve excluded domains and TLDs

Getting Started

To get started with the SubDomainRadar Python wrapper, you’ll need to install it via pip:

pip install subdomainradar

Once installed, you can start discovering subdomains with just a few lines of code!

Basic Usage Example

Here’s how to use the SubDomainRadar API to perform subdomain enumeration on a list of domains:

from subdomainradar import SubdomainRadarAPI

# Initialize the API client
api = SubdomainRadarAPI(base_url="https://api.subdomainradar.io", api_key="YOUR_API_KEY")

# Enumerate subdomains for a list of domains
domains = ["tesla.com", "google.com"]
results = api.enumerate_domains_with_results(domains=domains, group="Fast")

# Print the results
for domain, data in results.items():
    print(f"Domain: {domain}")
    print(f"Task ID: {data['task_id']}")
    print(f"Status: {data['status']}")
    print(f"Total Subdomains Found: {data['total_subdomains']}\n")

    print("Subdomains:")
    for subdomain_info in data.get('subdomains', []):
        print(f"  - Subdomain: {subdomain_info['subdomain']}")
        print(f"    IP: {subdomain_info.get('ip', '')}")
        print(f"    Country: {subdomain_info.get('country', 'No Country Info')}")
        print(f"    Reverse DNS: {subdomain_info.get('reverse_dns', [])}\n")

    print(f"WHOIS Information:")
    whois_info = data.get('whois', {})
    print(f"  Registrar: {whois_info.get('registrar', '')}")
    print(f"  Creation Date: {whois_info.get('creation_date', '')}")
    print(f"  Expiration Date: {whois_info.get('expiration_date', '')}")
    print(f"  Nameservers: {whois_info.get('nameservers', '')}\n")

In this example, we’re running a Fast enumeration search that quickly returns subdomains for the domains “tesla.com” and “google.com.” You can switch to Deep or Medium searches depending on how thorough you need to be.

Reverse Subdomain Search

One of the coolest features of SubDomainRadar.io is the ability to run reverse searches. If you’re looking for subdomains related to a specific keyword or part of a domain, this feature comes in handy.

Here’s how to run a reverse search using the Python wrapper:

# Perform a reverse search
results = api.reverse_search(subdomain_part="api", domain_part="car", tld_part="com")

for subdomain_info in results['subdomains']:
    subdomain = subdomain_info.get('subdomain', '')
    domain = subdomain_info.get('domain', '')
    tld = subdomain_info.get('tld', '')
    timestamp = subdomain_info.get('timestamp', '')

    if subdomain:
        complete_subdomain = f"{subdomain}.{domain}.{tld}"
    else:
        complete_subdomain = f"{domain}.{tld}"

    print(f"Complete Subdomain: {complete_subdomain}")
    print(f"Subdomain: {subdomain}")
    print(f"Domain: {domain}")
    print(f"TLD: {tld}")
    print(f"Timestamp: {timestamp}\n")

This allows you to find subdomains based on keywords or specific patterns, making it easier to locate targeted assets.

Try It Out Today!

If you’re looking for an effective, easy-to-use tool to discover all subdomains of a website, give SubDomainRadar.io a try. The SubDomainRadar Python wrapper makes it even easier to integrate subdomain discovery into your security workflow.

Ready to get started? Install the wrapper via pip and unlock the full power of SubDomainRadar.io today!