subchk — Subdomain Recon With Zero Dependencies
Standalone subdomain enumeration and HTTP fingerprinting CLI, no third-party packages.
I wanted a recon step I could run before a pentest or bug bounty session without pulling in a dependency tree bigger than the tool itself. Most subdomain enumeration CLIs lean on a dozen npm packages for DNS resolution, HTTP requests, and JSON parsing — things Node's standard library already covers.
subchk is the result: a single binary with zero runtime dependencies beyond Node itself.
Passive Enumeration First
Before any active DNS probing, subchk queries Certificate Transparency log sources — crt.sh, HackerTarget, AlienVault — to build an initial subdomain list from publicly indexed certificates. Passive sources don't touch the target's DNS infrastructure directly, so there's less noise and less chance of tipping off a WAF or IDS.
Active DNS resolution only runs against the merged, deduplicated set after passive collection finishes.
Passive enumeration first, then DNS resolution with wildcard filtering, then HTTP probing — all in one pass.
Concurrent DNS Resolution
Subdomains resolve concurrently across a worker pool. For targets with DNS wildcard records — where every random subdomain resolves to the same IP — the -w flag detects and filters wildcard responses, cutting false positives out of the result set before HTTP probing begins.
HTTP Probing & Fingerprinting
The -p flag confirms which subdomains are live and fingerprints basic tech stacks from response headers and body snippets — nginx, Cloudflare, Apache, framework hints. No separate httpx or whatweb invocation required.
Why TypeScript, Ported From Python
The original implementation was Python. I ported it to TypeScript to match the rest of my stack and because holding the zero-dependency constraint is easier in a typed codebase — you catch missing imports at compile time instead of discovering them in a clean CI environment.
Where It Is Now
v1.1.1 is stable. The CLI handles the full pipeline — passive enum, wildcard filtering, DNS resolution, HTTP probing — in a single command. Install it, point it at a domain, read the output.