An Asynchronous Cybersecurity Tool for Subdomain Enumeration and Network Intelligence Gathering

Abstract

Finding all the subdomains of a website is a crucial first step in security testing, whether performing offensive security assessments or building defensive asset inventories. Current tools force a choice between passive methods that gather information from public sources — potentially missing new or less-known subdomains — and active tools that directly discover hidden subdomains but can be slow and generate excessive noise. This paper presents Subdocker, a Python-based asynchronous cybersecurity tool designed to bridge this gap. Subdocker employs a smart combination of passive and active techniques, gathering subdomain intelligence from OSINT feeds, certificate transparency logs, and public DNS data, while actively probing via brute-force DNS resolution, HTTP(S) validation, and Web Application Firewall (WAF) detection. Optional Nmap integration enables open port and service identification. Subdocker is built with asynchronous programming libraries (aiohttp and aiodns) enabling high-speed parallel HTTP probing and DNS resolution, and features a modular design for easy extensibility. Experimental evaluation on the panimalar.ac.in domain discovered 47 unique subdomains within 90 seconds, resolving IP addresses, detecting WAF-protected endpoints, and identifying running services with high accuracy. Results demonstrate that combining passive and active methods leads to better coverage and fewer false positives compared to existing tools.