content/projects/usfx.md (1814B)
1 +++
2 title = "usfx"
3 description = "Ultimate Subdomain Finder X. Twelve enumeration modules, none of which phone home."
4 weight = 50
5 date = 2026-01-20
6
7 [extra]
8 tier = "brief"
9
10 eyebrow = "Subdomain discovery · Python"
11 tagline = "Every well-known subdomain tool starts by querying a service on the internet. On an internal network that is exactly the thing you do not have."
12 lang = "Python"
13 license = ""
14 version = "1.2.0"
15 platform = "Cross-platform"
16 repo = "https://github.com/sqzer-x/usfx"
17 stars = 1
18 accent = "#8fb9a2"
19 mark = ""
20 logo = ""
21
22 actions = [
23 { label = "Source", url = "https://github.com/sqzer-x/usfx", style = "ghost" },
24 ]
25
26 facts = [
27 { value = "12", label = "Modules" },
28 { value = "18,000", label = "Largest wordlist" },
29 { value = "0", label = "External services" },
30 { value = "1.2.0", label = "Version" },
31 ]
32
33 features_eyebrow = ""
34 features_title = ""
35 features_intro = ""
36 features = []
37
38 session_eyebrow = ""
39 session_title = ""
40 session_shell = ""
41 session_caption = ""
42 session_lines = []
43
44 cta_title = ""
45 cta_text = ""
46 cta_actions = []
47 +++
48
49 Point it at an internal DNS server and it works from there. Twelve techniques,
50 all of them offline:
51
52 DNS brute force · zone transfer (AXFR) · DNSSEC walking over NSEC and NSEC3 ·
53 record mining across MX, NS, TXT, SRV, SOA and CAA · reverse DNS sweep · CNAME
54 chain analysis · subdomain permutation · recursive sub-subdomain enumeration ·
55 virtual host discovery · TLS certificate SAN extraction · subdomain takeover
56 detection · web technology detection.
57
58 Three wordlists ship with it — roughly 500, 3,500 and 18,000 entries — and the
59 output has pipeline modes (`subs`, `web`, `ips`, `json`) so it chains into
60 whatever runs next instead of being parsed out of a report.
61
62 ```bash
63 pip install usfx
64 ```