GitHub-Subdomains
Enumerate subdomains from GitHub repositories
Recon & OSINT5 commands
#subdomain#github#recon#osint
Installation
1Install Go 1.16+ on your system
2Run the Go install command
3Configure a GitHub personal access token
4Verify installation
go install github.com/gwen001/github-subdomains@latest
# Verify
github-subdomains -hBasic Usage
GitHub-Subdomains searches GitHub repositories for subdomains by scanning code, issues, and commit history
# Basic search with token
github-subdomains -t YOUR_GITHUB_TOKEN -d example.com
# Output to file
github-subdomains -t YOUR_GITHUB_TOKEN -d example.com -o results.txt
# Raw output (pipe-friendly)
github-subdomains -t YOUR_GITHUB_TOKEN -d example.com -rawCommand Reference
5 commands
1GitHub personal access token
-t2Target domain to search
-d3Output file path
-o4Raw output (one per line)
-raw5Verbose mode
-vWhen to Use
1
Finding subdomains leaked in source code2
Discovering forgotten development/staging subdomains3
Expanding recon beyond traditional DNS sources4
Bug hunting for exposed internal endpointsNotes & Tips
1
Requires a GitHub personal access token (free)2
Higher rate limits with a token vs unauthenticated3
Searches code, commits, issues, and wikis4
Results may include false positives — validate with dnsx or httpxCommon Errors & Solutions
API rate limited
Use a GitHub token for higher limits or reduce request frequency
Token expired or invalid
Regenerate your token at https://github.com/settings/tokens