SubOver

Fast and efficient subdomain takeover vulnerability scanner written in Rust. Designed for bug bounty hunters and security researchers.

Installation

Quick Install

Using the install script:

curl -sSL https://raw.githubusercontent.com/Nonantiy/subover/main/install.sh | bash

Build from Source

git clone https://github.com/Nonantiy/subover.git
cd subover

cargo build --release

./target/release/subover --help

Docker

docker build -t subover .

docker run --rm subover -d example.com

System-wide Installation

sudo cp ./target/release/subover /usr/local/bin/
sudo chmod +x /usr/local/bin/subover

Usage

Basic Scan

subover -d example.com

Advanced Usage

subover -d target.com \
    --use-apis \              # Use external APIs for enumeration
    --verify \                # Perform HTTP verification
    -w wordlist.txt \         # Custom wordlist
    -t 100 \                  # 100 concurrent threads
    --timeout 15 \            # 15 second timeout
    -o results.txt \          # Save results to file
    -v                        # Verbose output

Options

OPTIONS:
    -d, --domain <DOMAIN>        Target domain to scan
    -w, --wordlist <FILE>        Wordlist file for subdomain enumeration
    -t, --threads <NUM>          Number of concurrent threads (default: 100)
    -o, --output <FILE>          Output file path
    -j, --json                   Output in JSON format
    -v, --verbose                Verbose output
        --timeout <SECS>         HTTP request timeout in seconds (default: 10)
        --service <SERVICE>      Check for specific service takeover
        --use-apis               Use external APIs for subdomain enumeration
        --verify                 Verify takeover with HTTP requests
    -h, --help                   Print help
    -V, --version                Print version

Examples

Check Single Domain

subover -d hackerone.com

Bug Bounty Mode

subover -d target.com --use-apis --verify -t 150 -o takeover.txt

JSON Output for Automation

subover -d example.com -j -o results.json

Custom Wordlist

subover -d example.com -w custom-wordlist.txt

Verbose Mode with Deep Scan

subover -d example.com --verify -v

Screenshots

Scanning Process

Real-time scanning with progress indicators showing subdomain enumeration, DNS resolution, and vulnerability detection phases

Vulnerability Detection Results

Detailed vulnerability report showing detected subdomain takeover vulnerabilities with severity levels

License

MIT License - See LICENSE file for details.

Acknowledgments

• Inspired by SubZy and similar tools
• Fingerprint database based on can-i-take-over-xyz

Author

Created for bug bounty hunters and security researchers.