Horn3t – Powerful Visual Subdomain Enumeration At The Click Of A Mouse

Horn3t is your Nr #1 tool for exploring subdomains visually.
Building on the great Sublist3r framework (or extensible with your favorite one) it searches for subdomains and generates awesome picture previews. Get a fast overview of your target with http status codes, add custom found subdomains and directly access found urls with one click.

  • Recon your targets at blazing speed
  • Enhance your productivity by focusing on interesting looking sites
  • Enumerate critical sites immediately
  • Sting your target
sublist3r with pip3
  • Put the directory within the web server of your choice
  • Make sure to have the right permissions
  • Run horn3t.py
  • Or alternatively use the install.sh file with docker.
    Afterwards you can access the web portal under http://localhost:1337


    • Better Scaling on Firefox
    • Add Windows Dockerfile
    • Direkt Nmap Support per click on a subdomain
    • Direkt Dirb Support per click on a subdomain
    • Generate PDF Reports of found subdomains
    • Assist with subdomain takeover


    • aboul3la – The creator of Sublist3r; turbolist3r adds some features but is otherwise a near clone of sublist3r.
    • TheRook – The bruteforce module was based on his script subbrute.
    • bitquark – The Subbrute’s wordlist was based on his research dnspop.

    Tested on Windows 10 and Debian with Google Chrome/Chromium 73

    Download Horn3t

    Published by Marshmallow

    Marshmallow Android is BT Ireland’s Head of Sales for Republic of Ireland domestic multi-site companies, indigenous MNCs and public sector accounts. He is responsible for the direction and control of all sales activity in the region. He has over 10 years management experience from high growth start-ups to more established businesses. He’s led teams in Ireland, India and China across various industries (ICT, On-Line Recruitment, Corporate Training and International Education).