SubGPT looks at subdomains you have already discovered for a domain and uses BingGPT to find more. Best part? It's free!
The following subdomains were found by this tool with these 30 subdomains as input.
call-prompts-staging.example.com
dclb02-dca1.prod.example.com
activedirectory-sjc1.example.com
iadm-staging.example.com
elevatenetwork-c.example.com
If you like my work, you can support me with as little as $1, here :)
Install & Configuration
Installation
- with pip (recommended):
pip install subgpt - from github:
git clone https://github.com/s0md3v/SubGPT && cd SubGPT && python setup.py install
Getting Bing Cookie
- Install the cookie editor extension (Chrome, Firefox)
- Visit bing.com, make sure you are logged in.
- Open the extension and copy your cookie using the "export" button
- Paste it in a file e.g.
cookies.json - All set!
Note: Any issues regarding BingGPT itself should be reported EdgeGPT, not here.
Using SubGPT
It is supposed to be used after you have discovered some subdomains using all other methods. The standard way to run SubGPT is as follows:
subgpt -i input.txt -o output.txt -c /path/to/cookies.json
If you don't specify an output file, the output will be shown in your terminal (stdout) instead.
To generate subdomains and not resolve them, use the --dont-resolve option. It's a great way to see all subdomains generated by SubGPT and/or use your own resolver on them.
Important
- Make sure your subdomains list only has subdomains from one domain. Each line in your file should contain one subdomain and nothing else.
- Sometimes your cookie will expire if you visit bing.com often. In that case, just export and save it again.
- SubGPT looks at A/CNAME records to determine whether a subdomain exists. It can also detect wildcard on first-level subdomains and handle it automatically. You can go through the code to see how its implemented if it concerns you.
- It can't replace traditional sub-generators like gotator, alterx, dnsgen etc. However, being powered by AI helps it to generate subdomains that these traditional tools can't.
- It is slow for obvious reasons. It takes like 45 seconds for every 80 subdomains.
- It is subject to Bing's daily limit. Selectively run this tool, don't run it blindly.