✅ Fast & Async • 🔐 Recon + Brute • 🔧 Easy to Extend
KnockPy is a modular Python 3 tool to enumerate subdomains via passive reconnaissance and bruteforce, now with async/await support, enhanced performance, and modern HTTP/TLS handling.
- ✅ Async scanning with
httpxand DNS resolution - ✅ Modular: plug new passive sources easily
- 🔍 Supports passive recon, bruteforce, or both
- 📜 Validates HTTP/HTTPS status, TLS cert, and IP
- 💡 Supports wildcard DNS detection
- 🧪 Output as JSON, optional save & reload
- 🔐 Supports VirusTotal and Shodan API
git clone https://github.com/guelfoweb/knock.git
cd knock
pip install .Only after the stable version is released on GitHub
pip install knock-subdomainsknockpy -d domain.com [options]| Flag | Description |
|---|---|
-d, --domain |
Target domain |
-f, --file |
File with list of domains |
--recon |
Enable passive reconnaissance |
--bruteforce,brute |
Enable bruteforce using wordlist |
--wordlist |
Custom wordlist (default included) |
--dns |
Custom DNS resolver |
--useragent |
Custom HTTP user-agent |
--timeout |
Request timeout in seconds |
--threads |
Number of concurrent workers |
--wildcard |
Test wildcard DNS and exit |
--json |
Output results in JSON |
--save FOLDER |
Save report to folder |
--report FILE |
Load and show a saved report |
--silent |
Hide progress bar |
--logfile |
Write debug log to file |
--show-settings |
Print scan settings and continue |
--version |
Show KnockPy version |
-h, --help |
Show help message |
knockpy -d example.com --recon --bruteforceexport API_KEY_VIRUSTOTAL=your-virustotal-api-key
export API_KEY_SHODAN=your-shodan-api-keyYou can use .env file:
API_KEY_VIRUSTOTAL=your-virustotal-api-key
API_KEY_SHODAN=your-shodan-api-keyknockpy -d example.com --recon --bruteforce --save report/
knockpy --report report/example.com_2025_10_25_14_00_00.jsonknockpy -d example.com --wildcardKnockPy can be used as a Python module:
from knock import KNOCKPY
domain = 'example.com'
results = KNOCKPY(
domain,
dns="8.8.8.8",
useragent="Mozilla/5.0",
timeout=2,
threads=10,
recon=True,
bruteforce=True,
wordlist=None,
silent=False
)
for entry in results:
print(entry['domain'], entry['ip'], entry['http'], entry['cert'])A default wordlist is included in knock/wordlist/wordlist.txt.
You can supply your own with --wordlist.
python tests/poc.pyLicensed under the GPLv3 license.
Gianni Amato (@guelfoweb)