Knockpy is a python tool designed to enumerate subdomains on a target domain through a wordlist. It is designed to scan for DNS zone transfer and to try to bypass the wildcard DNS record automatically if it is enabled. Now knockpy supports queries to VirusTotal subdomains, you can setting the API_KEY within the config.json file.

Very simply $ knockpy domain.com







Export full report in JSON If you want to save full log like this one just type: $ knockpy domain.com --json

Install Prerequisites Python 2.7.6 Dependencies Dnspython $ sudo apt-get install python-dnspython Installing $ git clone https://github.com/guelfoweb/knock.git $ cd knock $ nano knockpy/config.json <- set your virustotal API_KEY $ sudo python setup.py install Note that it's recommended to use Google DNS : 8.8.8.8 and 8.8.4.4

Knockpy arguments $ knockpy -h usage: knockpy [-h] [-v] [-w WORDLIST] [-r] [-c] [-j] domain ___________________________________________ knock subdomain scan knockpy v.4.1 Author: Gianni 'guelfoweb' Amato Github: https://github.com/guelfoweb/knock ___________________________________________ positional arguments: domain target to scan, like domain.com optional arguments: -h, --help show this help message and exit -v, --version show program's version number and exit -w WORDLIST specific path to wordlist file -r, --resolve resolve ip or domain name -c, --csv save output in csv -j, --json export full report in JSON example: knockpy domain.com knockpy domain.com -w wordlist.txt knockpy -r domain.com or IP knockpy -c domain.com knockpy -j domain.com For virustotal subdomains support you can setting your API_KEY in the config.json file.