skills.rest
hanmujun
hanmujunCOMMUNITY
Explore all skills by this author →
GitHub

ksubdomain-brute

Performs stateless high-speed subdomain brute-forcing and verification using ksubdomain raw sockets.

1|Updated Aug 3, 2026
Search Tags:#security testing#reconnaissance#dns enumeration#subdomain verification#stateless scanning#ksubdomain#subdomain brute force
One-click install
npx skills add https://github.com/hanmujun/hanmujun-agent-public --skill ksubdomain-brute-hanmujun
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ksubdomain-brute
Source: https://github.com/hanmujun/hanmujun-agent-public/tree/main/skill-library/ksubdomain-brute
Command: npx skills add https://github.com/hanmujun/hanmujun-agent-public --skill ksubdomain-brute-hanmujun

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Traditional DNS brute-forcing tools are slow when validating or enumerating large subdomain lists. This Skill uses ksubdomain's stateless raw-socket packet sending to perform subdomain verification and enumeration at speeds roughly 10x faster than dnsx, with bandwidth control. ## Core Features & Use Cases - Verify Mode: Validate the liveness of existing subdomain lists (e.g., subfinder output) at high speed with silent output options. - Enum Mode: Brute-force discover subdomains for a target domain using built-in or custom wordlists. - Advanced Control: Tune bandwidth limits, retry counts, and custom DNS resolvers for different network environments. - Use Case: During an authorized CTF or penetration test reconnaissance phase, pipe subfinder results into ksubdomain verify to quickly produce a list of confirmed live subdomains for further probing. ## Quick Start Use the ksubdomain-brute skill to verify the subdomains in subs.txt for the target domain and output the live hosts to alive.txt.

Frequently Asked Questions about ksubdomain-brute

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I brute-force subdomains with ksubdomain?▼

Run ksubdomain in enum mode with the target domain, for example: sudo ksubdomain enum -d target.com -o results.txt. You can supply a custom wordlist with -f and control bandwidth with -b to match your network capacity.

How to verify a subdomain list is alive using ksubdomain?▼

Use verify mode with a file of candidate subdomains: sudo ksubdomain verify -d subdomains.txt -o alive.txt. Add --silent for clean output, or pipe in subfinder results to confirm which discovered subdomains actually resolve.

ksubdomain vs dnsx for subdomain brute-forcing?▼

ksubdomain sends packets through raw sockets in a stateless manner, making it roughly 10x faster than dnsx for large-scale verification and enumeration. dnsx is a better fit when you cannot obtain root privileges, since ksubdomain requires them.

Does ksubdomain require root privileges to run?▼

Yes, ksubdomain requires root privileges because it operates raw network sockets directly on the network interface. Run it with sudo on Linux, or use an alternative DNS tool if elevated permissions are unavailable.

How do I control ksubdomain bandwidth and speed?▼

Use the -b flag to set a bandwidth cap, such as -b 5m for 5 Mbps or -b 1g for high-bandwidth internal networks. Combine with --retry to adjust retransmission counts for more reliable results on lossy networks.

Related Skills

Explore More Software Engineering Skills→
UseOSINTUseOSINT
38

find-hidden-subdomains

Enumerate subdomains and sibling domains from Certificate Transparency logs and passive DNS.

Official
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic
hpsgdhpsgd

domain-intel

Generate a structured Markdown domain intelligence report from passive public sources.

Official
Advanced
wgpsecwgpsec
1.7k

ksubdomain-brute

Performs stateless high-speed subdomain brute-forcing and verification using ksubdomain raw sockets.

Official
Basic