s0 is a quick subdomain finding tool. It works by fetching SSL records from crt.name and then enumerating the DNS records. It also lets you know if an IP that the subdomain is linked to belongs to Cloudflare or not.
MacOS/Windows/Linux Terminal & Bun installed.
| Name | Shorthand | Purpose |
|---|---|---|
| --domain | -d | Domain name to find the subdomains |
| --verbose | -v | Verbose logging mode |
| --help | Show available CLI options |
This tool is built for legal, authorized security testing and educational purposes only.
The developer assumes no liability and is not responsible for any misuse, damage, or illegal activity caused by this program. Users are entirely responsible for complying with local and international laws. Do not run this tool against any infrastructure unless you have explicit, written permission from the owner.