guelfoweb/knockpy
Knockpy
Knockpy is a DNS subdomain scanner and passive reconnaissance tool designed to discover subdomains and gather network intelligence. It functions as a DNS enumeration framework that combines active discovery methods with the ability to query external security services for passive domain data.
The tool identifies targets through a combination of wordlist-based brute forcing, DNS zone transfers, and the aggregation of data from external security APIs. To ensure accuracy, it includes wildcard DNS detection to filter out false positives during the enumeration process.
Beyond discovery, the system provides host security validation by probing endpoints for HTTP status and TLS certificate validity. All captured intelligence and scan results are managed through a local security research database that supports searching, deleting, and exporting data.
Features
- Subdomain Enumeration Workflows - Combines wordlist brute-forcing, zone transfers, and wildcard detection into a comprehensive DNS enumeration workflow.
- Subdomain Brute Forcing - Implements a combination of passive reconnaissance and active wordlist-based brute forcing to discover subdomains.
- Attack Surface Mapping - Maps the external attack surface by identifying accessible hosts and validating TLS and HTTP security.
- DNS Reconnaissance Frameworks - Provides a suite of utilities for detecting wildcard records and validating host security via TLS and HTTP checks.
- Passive Intelligence Gathering - Provides capabilities to query external security services for passive subdomain intelligence and network data.
- Passive Reconnaissance Aggregators - Aggregates subdomain intelligence from multiple external security APIs into a unified dataset.
- Passive Reconnaissance - Gathers hidden subdomains from external security services to map a target network's external surface.
- Subdomain Scanners - Discovers subdomains using a combination of passive reconnaissance, active wordlist brute-forcing, and DNS zone transfers.
- Host Security Audits - Probes discovered endpoints to verify SSL certificate validity and check for outdated security protocols.
- DNS Zone Transfers - Implements DNS zone transfers to retrieve complete zone files and uncover all registered subdomains.
- Wildcard Domain Detectors - Detects wildcard DNS responses to filter out false positives during the subdomain enumeration process.
- Host Security Validations - Probes discovered endpoints to verify SSL certificate validity and check for outdated security protocols.
- Command Line Tools - Listed in the “Command Line Tools” section of the The Book Of Secret Knowledge awesome list.
