subjack

No entries match these filters. Clear filters

1. v3.1.0 Oct 12, 2026 · issue 106

   subjack v3.1.0 makes SRVSRVA DNS record type that advertises the hostname and port for a specific service, letting clients discover endpoints without hardcoded addresses. takeover opt-in via -srv, fixes AXFRAXFRA DNS zone transfer request that asks a nameserver to send every record in a zone at once, letting cyber tools enumerate all hostnames in a domain if the server is misconfigured to allow it. detection, and switches availability checks to RDAPRDAPA JSON-based protocol for querying domain and IP registration data, standardized by the IETF as a modern replacement for WHOIS, giving cyber tools structured, machine-readable ownership and contact lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.1.0 https://github.com/haccer/subjack.git
   # already have the repo? check out this version:
   $ git checkout v3.1.0

   └──▷ TRY IT
   Scan for SRV record takeovers alongside standard CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. checks — useful when targets run SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic., XMPP, or LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. services with potentially expired backend domains
   copy

   $ subjack -w subdomains.txt -srv -t 50 -o results.json

   Use a custom resolver list with non-standard ports (e.g. an internal DNS forwarder) to route all subjack queries through specific resolvers
   copy

   $ subjack -w subdomains.txt -r resolvers.txt -ssl -o results.json

   • Adds -srv flag to opt in to SRV record takeover detection (~28 DNS queries per domain for SIP, XMPP, LDAP, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., IMAP, CalDAV, and more)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Switches domain availability checks from the heavyweight zonedb dependency to RDAP (RFC 9083) with a whois fallback, eliminating OOMOOMAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. on small VPSes
   • Allows -r resolver list entries in host:port format, not just bare IP addresses
   • Adds -srv flag to opt in to SRV record takeover detection (~28 DNS queries per domain for SIP, XMPP, LDAP, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application., IMAP, CalDAV, and more)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

2. v3.0.0 Mar 16, 2026 · release notes

   subjack v3.0.0 expands beyond CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. hijacking to cover stale A records, dangling NS, AXFRAXFRA DNS zone transfer request that asks a nameserver to send every record in a zone at once, letting cyber tools enumerate all hostnames in a domain if the server is misconfigured to allow it., SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders./MX, and SRVSRVA DNS record type that advertises the hostname and port for a specific service, letting clients discover endpoints without hardcoded addresses. takeovers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.0 https://github.com/haccer/subjack.git
   # already have the repo? check out this version:
   $ git checkout v3.0.0

   └──▷ TRY IT
   Scan a domain list for stale A records on cloud providers — useful after a cloud VM is deleted but DNS still points to the old IP.
   copy

   $ subjack -w domains.txt -ar -o results.txt

   Check for dangling NS delegations and zone transfer exposure in one pass, piping targets from a recon tool.
   copy

   $ cat domains.txt | subjack -ns -axfr -o results.txt

   Hunt for SPF include and MX record takeover opportunities across a list of targets.
   copy

   $ subjack -w domains.txt -mail -o results.txt

   • Adds stale A record detection across AWS, GCP, Azure, DigitalOcean, Linode, Vultr, and Oracle Cloud via -ar.
   • Adds dangling NS delegation checks for deleted cloud DNS zones on Route53, Google Cloud DNS, Azure DNS, and others via -ns.
   • Adds zone transfer (AXFR) detection with NS hostname bruteforcing via -axfr.
   • Adds SPF include and MX record takeover detection for expired domains via -mail.
   • Adds CNAME chain takeover detection traversing multi-level chains up to 10 deep.

   +4 more show less

   • Adds SRV record takeover detection for SRV targets pointing to registrable domains.
   • Adds Azure Traffic Manager API verification to reduce false positives.
   • Supports piping domain lists via stdin.
   • Writes all results to the output file, not only vulnerable findings.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Heroku and Fastly fingerprints have been removed from the fingerprint set, so targets previously flagged for those providers will no longer be detected.
3. v2.2.0 Mar 15, 2026 · release notes

   subjack v2.2.0 adds embedded fingerprints, custom DNS resolvers, and a new Kickofflabs takeover detection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.2.0 https://github.com/haccer/subjack.git
   # already have the repo? check out this version:
   $ git checkout v2.2.0

   └──▷ TRY IT
   Use a custom resolver list instead of system DNS to avoid rate-limiting or improve accuracy during large subdomain takeover scans.
   copy

   $ subjack -w subdomains.txt -t 100 -r resolvers.txt -o results.json -json

   • Embeds fingerprints.json directly into the binary at compile time — no external config file required.
   • New -r flag to supply a custom list of DNS resolvers with random selection and fallback.
   • Adds Kickofflabs subdomain takeover fingerprint detection.
   • Migrates to Go modules (Go 1.25), enabling standard go install distribution.
   • Adds GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. CI pipeline with automated cross-platform release builds.

   5 details in Everything

4. 1.3 Apr 7, 2018 · release notes

   Adds NXDOMAIN checking, new fingerprints, and Amass option support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.3 https://github.com/haccer/subjack.git
   # already have the repo? check out this version:
   $ git checkout 1.3

   • Adds --nxdomain flag to check for subdomains pointing to non-existent domains and their registration availability
   • Adds JetBrains & Microsoft Azure fingerprinting capabilities
   • Adds more Amass options support

   3 details in Everything