From e03afabf8c5659cb6743155692a7d2be88950168 Mon Sep 17 00:00:00 2001
From: B0lg0r0v <115954804+B0lg0r0v@users.noreply.github.com>
Date: Wed, 29 Nov 2023 17:05:45 +0100
Subject: [PATCH] v0.5-alpha

- New "-sdo" functionality. This subdomain enumeration function uses multiple free online tools to scrape the subdomains of your target. This enumeration technique is very fast and should be used over the "-sd" argument.
- Improved code logic
- Improved exception handling.
---
 src/.DS_Store                                 | Bin 6148 -> 8196 bytes
 src/core/.DS_Store                            | Bin 0 -> 6148 bytes
 src/core/__pycache__/dnsfunc.cpython-310.pyc  | Bin 0 -> 2975 bytes
 .../__pycache__/subdomain.cpython-310.pyc     | Bin 0 -> 4093 bytes
 src/core/dnsfunc.py                           |  93 +++++++++
 src/core/subdomain.py                         | 125 ++++++++++++
 src/elixir.py                                 | 190 +++++-------------
 src/requirements.txt                          |   1 +
 8 files changed, 274 insertions(+), 135 deletions(-)
 create mode 100644 src/core/.DS_Store
 create mode 100644 src/core/__pycache__/dnsfunc.cpython-310.pyc
 create mode 100644 src/core/__pycache__/subdomain.cpython-310.pyc
 create mode 100644 src/core/dnsfunc.py
 create mode 100644 src/core/subdomain.py

diff --git a/src/.DS_Store b/src/.DS_Store
index 60146e9f08da5be54bf78928d8cb96e816c7c0f5..931ecfb38e86b799991c326e3931d6950254e08c 100644
GIT binary patch
delta 641
zcmZ8fL2nX46n>9gWpS}gDW#|v1P^V3%_3>FUO<c?O%ow4F;uH$fdMxzJGi^FRAZ<~
zZypTU#EYgE51w@|CLa6~o;4o4dFaiX=`2fI<0LcRmpAYG-pkC}SN01D0Kj6ul?Cvq
z#J7h;9zBhZ7B8dxvGN7oLt#$j$1i*zl%&y~h_W*!#NAZj6)uR-1O_J1(t1VdTeivN
zBHRTPx<JQ#a_^)9FK4qkC6ipbmV1#&KF{W|E1Bf-jTPr}AU8bm(VE-6hRzziu{VvL
zu35IC{2&nw2;!NuK`C@j4xgWjkm)FyA+cC=Ha?d~T&$CshT446F<IYe-DWy7i+Z0v
z=$Kk-qo+1Cqf@i#z~0cF(K?C#m%2_{kA|nQ>TZuG#ZCibzmiF*F*Yo>+ZMHJ|M1QG
z>YzHY-?ARFomHE5SB*B~wYD|7Q|{RsGpu{mv^Z|6rl}eoTHJl8s|~7`jUuy$HtW_&
zWGrqnqheA|SkpN7noj2r`CIapF037sd7ltS`-FcV!K$HlX(*H~R3<?Q79bC6Pz4PJ
z@EYF22lxbE;TwF1-|!cMNbmxtZsHZZii@b=5-#I)UmU=R$))28K4O96$%i=yLf$=y
nwT01Mcv|o?5;Dg--XOU@g+GE5iQRHaVIpxuZ^po_hu;ZDONgGp

delta 120
zcmZp1XfcprU|?W$DortDU=RQ@Ie-{MGjUEV6q~50$jH7iU^gQp`(!>rvCT>X-Hek{
zMGQ8UXt6A2=im@z2C4)C0d64S3evQ(@H_Klei=uQsSJz^3@jj;31Tc*Y;!!%9A*Hd
C;t}ou

diff --git a/src/core/.DS_Store b/src/core/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..603f34c89f2e506b839afea022af110768014e2c
GIT binary patch
literal 6148
zcmeHKyG{c!5S)b+5ur#)=`V=H9~@CAsQG|{TtFZt91^;M?s`6kPlVYApd42sgwU?E
zo{ha@`$mfG1t80Aa|+A>OzDcE!H8-1=+HqV9}>mpXmE`Ncep`4GSOe`(!I~P+ZvB}
z=H9>dUtet7X1#6K%uspG=!-WqM!*p^c)$~G(GeRgbcO-vb-+1heup)gEp}Y%p3D)R
zybO4{URo-U3Zw$5Kq~Mv3h>TWo6a1wO$AbcRNzwqJs%2Pu?p-R?dV`*B>-{4ZZpRE
zSXNF6tO9#Sj?l!ZM5juW7~*vHm&mIEdq<~3qWF+l`J;FdTb=V4ONUgB*`@-iz`g=n
z`_krm|DW?OGg{<ZN;auLD)3(wkjd(DwdB{u-TLi2^{y@SE4rHI^%~F^?>z$eL(h>D
d8}#v_G4rax-ce`KexnofAz*@JlM4KT0`HT3H<|zd

literal 0
HcmV?d00001

diff --git a/src/core/__pycache__/dnsfunc.cpython-310.pyc b/src/core/__pycache__/dnsfunc.cpython-310.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..b37e61501f67346ab0eef21c4f226fb572997452
GIT binary patch
literal 2975
zcmaKu-Ez}L6vwraEXj_Om=GE|P!KHyJVR~1hh{n*Oze^jL1CPv0n?7hc$JJoESZ&D
zu<BgF8}yRNOhT{v4((g?YHxehH-PkGdd{xm#9)v{XLq%G&T3cxpN@jj(ToB|xxVh6
zA5)Y+v2pm&pm7VX@Fp0lP_n7ih$z*h)N168LRG50RH*hst?AIxX$o2?Xr(AwQu4-M
z;H@}Kw1*D@jazVqm%z9pa!sYArcsDPHSpGJ22IsWYSb)h*3#6fWoWuKLNgF`gqx3>
z!Dhh1ICbLDSJzvjxF(AmvbZ9PtFpM<iuDtZE(t5^*IG_K%dL9dZ?xQcooDLxRzN$O
zSkKn$Pdkmxq{o=6l**MVHx}>SURbGMIs35WaC7nQoob~5mDN(!nRo7R{oB&~0@o`}
zd6w(97Z=Jrz2boD!n{-YRbk_>R$=yT6jwr*g~gV4vsezAotEoIVeyU^&2=6ZE1TYP
zj}=4KEH(q?7O5Yub^K<b-DN67Na40kg0U2x44xJdBi`F>bi0LaXTcooHdS9Lu;Uul
zp@cU_4JcF8gdMi{7))F7;mKGd@&dn!Z*2cCp^}Ab7Orp(de%W7ugMl!SGH8Rw0NaQ
z%E}M-xAgc*q->BKwWsv-U3DwfOTqo=Eu*LIXpz2=dZmChUP13G(9*WvGj_~fWeV?F
zQ=qFUWtR}8r|oERgzSg0+P028Pp4Lurz5(8vuvchzYqn_Bzk5bx{fi0r-7ai!EaUZ
zuOz-B-LCYFvM}zzQvr|Ef#(b1=}#qIqutlTyr>~PwskpP#Kb5DtjXLN>#4hBe~mbz
zr!6VZ;LKZ2KFvvq>m@k2>MZfptW&yI;o9<pWv(qPmbi9*xysdh51>{3E>>r3PBQVa
z8N2F&TBz*@k?lVB!pQU2<D5+cH$1pk*qe3&+gY;Lf{st^fI*k-`H{<fH?o_7@4HQW
z+Xb%V$GHX);1+YkVDm?paWkoLqtR}=J{4MHY0v;01;foKs7LPeh@mvN<pd=^eC9GX
zBAXA&i}y<N4o|fi%*dylpqfOU4g584y(5Lj^^L&u^CmZF&}w+T5Tab$a<}b<+yHXm
zacWsvE_R}JC*m1+RyitUws@L`m_0n8j^*(Fku}e!rOnN9e>}1jUIb$aoK)2!Dj6dd
zDUg#y|1YOqAo|;!HBEBl6tPuZRsUB1iS0o?3h#w&B6a)605Ls5OhU@{f|OMt<?;|x
z&V7Isvd=-HOm*8F;H2M=ObJeo0w-pllixqW337>?sM~^*K70B$s8(=e0yp!0Zhjg@
zK<^MY+o^<_qVO5r80-E#%;#Nd`jm}#e;Yd9{0L>%PVR%0rJXpP@G@hw6Y!GaW5f6<
z#Geeko!LA34p;zNAwFGU43P4CyBl<v%_NXv)QDXCz!%s_n2CJ`CVzyT!un}6HkvbN
zP%#HUvCpxIFtIPtAV&<p;Orb2o@TTGp@9jWTk)Ux!85<Qe}_%uu=8N@CcA*64f!+z
z=XT(SZfy*37BxvwEh9%DWb%;^iFfIlK$$PK-KMwZH6?F2Or&wlMF;R)OyD_7CW-zg
zmpKdg*b*TP5ZY7U#Ak*eG#Gmz>tN!;JrG&v52!$<5g8|*=_!y^u5W1xLE0|a(tBhu
z!%z~L&~NRedpcEj;lJfm<pmKL0>1WCPt*>13BLD3N5UA03^@n&e@1B8+8F72hqO65
zkZ~{zKy0ah%t<1Lnfn|?S!zKpAiG5502OmU9<-UOy6}MuU3(!2o^;wE(c`dMh8b9j
zb#i||89wFxK?UfKCx-|#BQ-ZJG{;AnjE;XdJiEq%R=q(fh#?#%Lav1oJET(~$G!-q
zCWX#YJngkhG7$W-`Jn^x!y5iZh+6WU*1UGeQ#ki~U*^%|!Q_JGU^O8EvoEVGxk09h
z{%=mV$pjfg5xtF1z9XT55Ki7;8g8172Ia%PL~|9*44VEQnXF-gU`N1Az!h3xEX7i-
z<JptqZr<Qon6HrJK_>ST*II}J-{s@7Q@lG|q2w9k4V#EtU&|lPZ}7#2_%{x-LE0Hp
HCr1AV$BWR3

literal 0
HcmV?d00001

diff --git a/src/core/__pycache__/subdomain.cpython-310.pyc b/src/core/__pycache__/subdomain.cpython-310.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..c0ab9c8c93a85ddd807913a61733bda4eca789f7
GIT binary patch
literal 4093
zcma)9-E-8|71zDeO4{}M1BU_)WY|*L$r5|lCP4WJ9|jw6ah42(5SB?jT1mF$Xr=X)
zgl)}k`(S2p9x};8-)Ls+$NU-nH|}FI)0w{Yt!<`({*GkFiy_l!t#i*k_fx-n&hK1@
zgM%dnPx|4advrumzN1S2qoQ&RZ}dk9M{$_1v{{oe(z(x@9Hr{3ZLO*8*b2=;)}}X&
ztTcDZ;!as=mNNT5vwTZ&G^g-XaS9u}If$C>7^oSj4WVW_MbwI@4Lkh4QZ4-hdr+!O
z4qkVyB=!~(|9+Ts8n76`3LGzpZR*kgFjTJLjV2&mrO6xxduC15;Z4m^u~)6BI|b}b
zZ<>zLEIKCkS8NVAC9F6gjg}qyp@`DL(Z?6gwzJ|)UYyH|(|PfJUQD)A?dao)Oy>HT
zcB5LB=KOqMwcYu7S(=}3hfd;?UY?&{Ni2V-MZY~WH9d1r>UZy4pL;Mv<&8&E4QbrH
zbL-yB43vjc_ZqW}TT;6@H9IG@na1=Dsa?N2H!X_~8W=h^+nD)Q5eM+CnfU&E{Xyi4
zsNVL@*QY}}X}duj)o*$6?W9$o@x3)q)FWZn?NGS&C}}xi+wy{1XI*HRqfEdZgfJD2
zz4|j**5ft2IeK5CVJ9K>@OJo91(>Ujh7xD)=qL-00gO#K5(d5(xc7ILk8C=%-KPk}
z#Crp8^k)c%(QG}osPwp__S7!hP<k4968R5#O;>xae8ZiRGw>IqS8&QycLu*vouR`@
zSIKmKSlP2fAI3X!Sn27p60>FARl9|*?i~11T~?jZ4c;@l#+K&1wauoL&y1eg<y(cW
zxs5njxz;7$JlJ>z3W9+Uyic1xlx@0)fax)szN=u%e1l<_+VBmu;;B3>zPs|B`=6qz
zWTuyYdU^HK{MVoVJ^icwky7PSjbb5G^n_lBVoStQbpvPbu*E1EWtk%3dYA-`CDz}8
zCDI}2@P=4=Za>nsDDgTo0sKN(u@?rl5B$)!{OC%pf1338QXF@pi*>k&*QvF<w0_mH
z<I8ZE1ut-1k(#>=>CF$r)bo9-ezrDIdH2)F$xD?vFG$uZYv<3+pF4A@BA#5FoVZY%
zs8(*d_UB>!^u*)@{w6CoJ>f2dYxT)V3{4-z?pj=5irfB})#>=2o$ar_Mwa*1_FLQj
zrIpJQwF_fj+gfz%))Q}GM_qMWov~B(Q(61@bjS_HAKV{vgRFiwJ+PR1ow17JF8EgL
zj#XMBz0gkl*y{k``a&q$<Bk<umny9tNH357^wU&NzyG_cA+_6K6sIK$z456<gq+l;
zY}@U`>2O|-&so7@f}Q?om<j9<1h$x#Z-haNA>$vfciePnw>IYni}6zW&QC9n7RgHK
z*zSmFFY1JmN2hwR()S@mHkVH%!aq?er4v7|H$t=R#giD()N>t9Xe_xF&OVYFA@uzK
zolFg|;j5+E5pGo%6b8~1?n>fDF*;&Hu{7-b3#CTRBXt}v{J2__dd@!LFpVlKp>HHr
zY*d=N;ESWwq_sk4U1|}yU;GM&{UI>C&#7rpbOOTUT0!GF<0@zQ&qS&JyH-BJhgg|u
zJgxk{2ziB@ve3fB88^*A0VgpB0Z#nW;}q;$yvw&4ScHQ`)ULX$#f2@MdTcXC{gU;x
zu9k61q06?6ZXx58V_hN#t&xuI2A(bATC`NZx^h`iP$T8(-~%{J)yz;9$6=M~q8n$B
zG)=;G-tv9Pg-ejPJD%@~U(;A!5IKwAkoYZ$DuguJR%|c1kt}4&eozb8!TqI6=ot+`
zXuQNn*+FLV47NkB!IpJ@1uWu2dNZ*80ENJcm8}e}ZPIuS3uqXi0hD6|SeHFvVhrFw
zCvai_xUAzfK<4UU1)6zS*+5HI<q8Aku8cU4Ro18$#amcMoFXwvg1%oCIsh)t@|PGO
z>o5uWs;ZVjBTG(_Qx4!Lf#q_?jG6_~qy5lmlrwK*cti}W@gv-1CM&VGA^8v5%k&qo
zp+h4YIEVtROkN}?4fJjFELDHZ<GDt&XCL%SC=umE6E1C5%7dBJhT)ZmqVF2sEQP<G
zi^;>}!Ins3_hu;UpUS_qMasb{&Ga{j7#WyyB=RUnslwMaf`3u@0y+5$P6xE5Z&RLC
zk%hGl{?$m2k#}!r2fJmWR3G97so}SwG9@r4m1ukwbI|V*-e<})_KZJM7xKG;+0)|U
za%pQ|TlwnH7fNbwDqG0va0t$nhe~i<Q{ut(rF=ZvhPJbLf)eI^)IaYga&`a8R9}6~
zQZ*XlZG35Z^6`70RX}+8`6D?1E8<eytz;S4b!xR*dZb>f)qM|iwReSzYVleunRq1v
z2tsl=a?0qRw7|7kStg25w$uzTwn=b;EVgl1=rWOPvMp_YD@DO3T}19toNRK$$JI@a
zejpmeM<Ldijpqua`5f1s{+VGbVt$>DYvp(mFMz`imP?r&$YdFEaCvA!TmNMDKq#Kj
zb9j9vw`6OK?5^RcJM(640Qe8&@YARq+#K|b(j==%HkBSK_1!uuwiVc}4>YTzQgwoe
zaz+&TPmoEB9ZeSeaMcxA1dG$a?oIJ4&BmwGcR!q(Z9ogBf(RqzU?XfG=OHa&J|rPZ
zfU-2x?!@bJR?GF}fjjPcE3||&i_9xT(uu_&7LaDNl*CTB8dOzr28O2Lbw08D#FcFA
zTTPnonrkO<D5OS*-!uYubq<Ow<8lTfp3d&ld!Z`_+`Wrd3-e_;iL+z4n;ijF5M`WV
zntGDy$VJC+U*j+If9WsMD{qQX+}w8DvJc3;>s#Ma)!{z8=t`eaozz04UCF~p>e#Hk
z>PSr>p@Z*0eKB3g!F@>8b|M5_VT^?&PH-4<^y4M!_)!@8GrI_=ZL1@0(A?7y)q<Es
zK?xo?X9{YQSTqMD62GT@8MoaeExWcJeADMVLUS|*aU}ci;}CeY#E!if)ykusjR2%F
z8~LxM^A{zOKk%2O7n+_{e>PkV@cljpe(>Yo_Q*Hm-E(MoNc*7_W-4Va$Wk3?s;%fu
zUkcXg;vBZKo4OcB7g>fw*LM9`TqKi8rZfy(Ih;3=XS(E=f^HFVbPxC14(#G1G~_;?
m<uqFTO$kDpALRdDUZH=Yq9YJx#RO91V7tE|b!c$(%KrfTFar_*

literal 0
HcmV?d00001

diff --git a/src/core/dnsfunc.py b/src/core/dnsfunc.py
new file mode 100644
index 0000000..cdb1bef
--- /dev/null
+++ b/src/core/dnsfunc.py
@@ -0,0 +1,93 @@
+import dns.resolver
+import dns.zone
+import dns.reversename
+
+class bcolors:
+    HEADER = '\033[95m'
+    OKBLUE = '\033[94m'
+    OKCYAN = '\033[96m'
+    OKGREEN = '\033[92m'
+    WARNING = '\033[93m'
+    FAIL = '\033[91m'
+    ENDC = '\033[0m'
+    BOLD = '\033[1m'
+    UNDERLINE = '\033[4m'
+
+#----------------- Record Enumeration -----------------#
+
+class dnsEnumeration:
+
+    def findAllDnsRecords(domain):
+        dnsRecordTypes = ['A', 'AAAA', 'NS', 'CNAME', 'TXT', 'SOA', 'PTR', 'MX', 'SRV']
+        server = []
+        serverOutput = []
+
+        try:
+            for dnsRecords in dnsRecordTypes:
+                try:
+                    resolve = dns.resolver.resolve(domain, dnsRecords)
+                    for answers in resolve:
+                        server.append(f'{bcolors.OKGREEN}{bcolors.BOLD}{dnsRecords}: ' + answers.to_text() + bcolors.ENDC + '\n')
+                        serverOutput.append(f'{dnsRecords}: {answers.to_text()}\n')
+                except dns.resolver.NoAnswer:
+                    server.append(f'{bcolors.FAIL}{bcolors.BOLD}{dnsRecords}: Record not existing{bcolors.ENDC}\n')
+        except dns.resolver.NXDOMAIN:
+            print(f'{bcolors.FAIL}{bcolors.BOLD}{domain} does not exist.{bcolors.ENDC}\n')
+        except dns.resolver.NoResolverConfiguration:
+            print(f'{bcolors.FAIL}{bcolors.BOLD}No NS found or no internet connection.{bcolors.ENDC}')
+
+        print(bcolors.OKGREEN + bcolors.BOLD + ''.join(server) + bcolors.ENDC)
+        
+        return serverOutput
+
+
+    def findSpecificRecord(domain, record):
+        response = []
+        responseOutput = []
+        
+        try:
+            for recordType in record:
+                try:
+                    resolve = dns.resolver.resolve(domain, recordType)
+                    for answers in resolve:
+                        response.append(f'{bcolors.OKGREEN}{bcolors.BOLD}{recordType} Record: {answers.to_text()}{bcolors.ENDC}\n')
+                        responseOutput.append(f'{recordType} Record: {answers.to_text()}\n')
+                except dns.resolver.NoAnswer:
+                    response.append(f'{bcolors.FAIL}{bcolors.BOLD}{recordType} Record not existing.{bcolors.ENDC}\n')
+                    responseOutput.append(f'{recordType} Record not existing.\n')
+
+        except dns.resolver.NXDOMAIN:
+            print(f'{bcolors.FAIL}{bcolors.BOLD}{domain} does not existing.{bcolors.ENDC}')
+        except dns.rdatatype.UnknownRdatatype:
+            print(f'{bcolors.FAIL}{bcolors.BOLD}Error in your record statement.{bcolors.ENDC}')
+        except dns.resolver.NoResolverConfiguration:
+            print(f'{bcolors.FAIL}{bcolors.BOLD}No NS found or no internet connection.{bcolors.ENDC}')
+
+        
+        print(bcolors.OKGREEN + bcolors.BOLD + ''.join(response) + bcolors.ENDC)
+        
+        return responseOutput
+
+
+    def reverseLookup(ipAddress):
+        dnsNames = []
+        dnsNamesOutput = []
+        
+        try:
+            for ips in ipAddress:
+                names = dns.reversename.from_address(ips)
+                dnsNames.append(f'{bcolors.OKGREEN}{bcolors.BOLD}Reverse Lookup: {str(dns.resolver.resolve(names, "PTR")[0])}{bcolors.ENDC}\n')
+                dnsNamesOutput.append(f'Reverse DNS Lookup: {str(dns.resolver.resolve(names, "PTR")[0])}\n')
+        except dns.resolver.NXDOMAIN:
+            print(f'{bcolors.FAIL}{bcolors.BOLD}{names} does not existing.{bcolors.ENDC}')
+            dnsNamesOutput.append(f'{names} does not existing.\n')
+
+        
+        print(''.join(dnsNames))
+
+        return dnsNamesOutput
+
+#---------------------------------------------------------# 
+
+
+
diff --git a/src/core/subdomain.py b/src/core/subdomain.py
new file mode 100644
index 0000000..8c5ba4e
--- /dev/null
+++ b/src/core/subdomain.py
@@ -0,0 +1,125 @@
+from bs4 import BeautifulSoup
+import requests
+from random import randint
+import re
+import dns.resolver
+import dns.zone
+import dns.reversename
+import os
+import concurrent.futures
+
+
+class bcolors:
+    HEADER = '\033[95m'
+    OKBLUE = '\033[94m'
+    OKCYAN = '\033[96m'
+    OKGREEN = '\033[92m'
+    WARNING = '\033[93m'
+    FAIL = '\033[91m'
+    ENDC = '\033[0m'
+    BOLD = '\033[1m'
+    UNDERLINE = '\033[4m'
+
+#----------------- "Online" Subdomain Enumeration -----------------#
+
+class onlineSubdomains:
+
+    def suipEnumeration(domain):
+
+        def randBoundary():
+            start = 10**(29-1)
+            end = (10**29)-1
+            return str(randint(start, end))
+
+        hosts = []
+
+        url = 'https://suip.biz/?act=subfinder'
+        boundary = randBoundary()
+        headers = {
+
+            'Host': 'suip.biz',
+            'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0',
+            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
+            'Accept-Language': 'en-US,en;q=0.5',
+            'Accept-Encoding': 'gzip, deflate, br',
+            'Content-Type': f'multipart/form-data; boundary=---------------------------{boundary}',
+            'Content-Length': '237'
+
+        }
+
+        body = f'-----------------------------{boundary}\n' + 'Content-Disposition: form-data; name="url"\n\n' + f'{domain}\n' + f'-----------------------------{boundary}\n' + 'Content-Disposition: form-data; name="Submit1"\n\n' + 'Submit'
+
+        soup = BeautifulSoup(requests.post(url, headers=headers, data=body).content, 'html.parser')
+        for content in soup.find('pre'):
+            hosts.append(content)
+        
+        return hosts
+
+
+    def crtSh(domain):
+        
+        hosts = []
+
+        url = f'https://crt.sh/?q={domain}'
+        soup = BeautifulSoup(requests.get(url).content, 'html.parser')
+        matches = soup.find_all(string=re.compile(f'{domain}'))
+        
+        for match in matches:
+            hosts.append(match)
+        
+        return hosts
+
+    def main(domain):
+
+        duplicates = []
+        
+        subdomains = onlineSubdomains.suipEnumeration(f'{domain}') + onlineSubdomains.crtSh(f'{domain}')
+        for subds in subdomains:
+            if subds not in duplicates:
+                duplicates.append(subds)
+                print(bcolors.OKGREEN + bcolors.BOLD + subds + bcolors.ENDC)
+                return subds
+
+#---------------------------------------------------------# 
+
+#----------------- Brute Force Subdomain Enumeration -----------------#
+
+class bruteForceSubdomains:
+
+    def subdomainEnumeration(targetDomain):
+        print(f'\n{bcolors.WARNING}[+] Subdomain brute force started...{bcolors.ENDC}')
+        list = []
+        newList = []
+
+        with open(f'{os.getcwd()}/../lists/subdomains.txt', 'r') as file:
+            name = file.read()
+            subDomains = name.splitlines()
+
+        def enumeration(subdomains):
+            try:
+                ipValue = dns.resolver.resolve(f'{subdomains.lower()}.{targetDomain}', 'A')
+                if ipValue:
+                    list.append(f'{subdomains.lower()}.{targetDomain}')
+                    for x in list:
+                        if x not in newList: #We check for duplicates
+                            newList.append(x)
+                            print(f'{bcolors.OKGREEN}{bcolors.BOLD}{subdomains.lower()}.{targetDomain}{bcolors.ENDC}')
+
+                        else:
+                            pass
+            except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers, dns.name.EmptyLabel):
+                pass
+            except KeyboardInterrupt:
+                print(f'{bcolors.FAIL}{bcolors.BOLD}\nEnumeration canceled.{bcolors.ENDC}')
+                executor.shutdown()
+
+        with concurrent.futures.ThreadPoolExecutor() as executor:
+            try:
+                executor.map(enumeration, subDomains)
+            except KeyboardInterrupt:
+                executor.shutdown()
+        
+        return newList
+
+#---------------------------------------------------------# 
+
diff --git a/src/elixir.py b/src/elixir.py
index e2bc7d6..5530fc3 100644
--- a/src/elixir.py
+++ b/src/elixir.py
@@ -8,10 +8,14 @@
 import requests
 import pyasn
 from asn_build.build_asn_db import buildASNdb
+from core.subdomain import onlineSubdomains, bruteForceSubdomains
+from core.dnsfunc import dnsEnumeration
 import re
-import time
 import concurrent.futures
 
+#---------------------------------------------------------# 
+
+
 class bcolors:
     HEADER = '\033[95m'
     OKBLUE = '\033[94m'
@@ -30,33 +34,6 @@ def list_to_string(string):
     temp = ''.join(string)
     return temp    
 
-def findAllDnsRecords(userInput):
-    dnsRecordTypes = ['A', 'AAAA', 'NS', 'CNAME', 'TXT', 'SOA', 'PTR', 'MX', 'SRV']
-    server = []
-    serverOutput = []
-
-    print(f'\n{bcolors.WARNING}[+] Finding all DNS Records...{bcolors.ENDC}')
-    try:
-        for dnsRecords in dnsRecordTypes:
-            try:
-                resolve = dns.resolver.resolve(userInput, dnsRecords)
-                for answers in resolve:
-                    server.append(f'{bcolors.OKGREEN}{bcolors.BOLD}{dnsRecords}: ' + answers.to_text() + bcolors.ENDC + '\n')
-                    serverOutput.append(f'{dnsRecords}: {answers.to_text()}\n')
-            except dns.resolver.NoAnswer:
-                server.append(f'{bcolors.FAIL}{bcolors.BOLD}{dnsRecords}: Record not existing{bcolors.ENDC}\n')
-    except dns.resolver.NXDOMAIN:
-        print(f'{bcolors.FAIL}{bcolors.BOLD}{userInput} does not exist.{bcolors.ENDC}\n')
-    except dns.resolver.NoResolverConfiguration:
-        print(f'{bcolors.FAIL}{bcolors.BOLD}No NS found or no internet connection.{bcolors.ENDC}')
-
-    if outputBool:
-        serverOutput.insert(0, '\n#----------------#\n')
-        serverOutput.extend('#----------------#\n')
-        outputFunction(list_to_string(serverOutput))
-    
-    return(list_to_string(server))
-
 
 def zoneTransfer(userInput):
     hosts = []
@@ -90,98 +67,6 @@ def zoneTransfer(userInput):
     return(list_to_string(hosts))
 
 
-def findSpecificRecord(userInput, record):
-    response = []
-    responseOutput = []
-    print(f'\n{bcolors.WARNING}[+] Finding {record} Records...{bcolors.ENDC}')
-    
-    try:
-        for recordType in record:
-            try:
-                resolve = dns.resolver.resolve(userInput, recordType)
-                for answers in resolve:
-                    response.append(f'{bcolors.OKGREEN}{bcolors.BOLD}{recordType} Record: {answers.to_text()}{bcolors.ENDC}\n')
-                    responseOutput.append(f'{recordType} Record: {answers.to_text()}\n')
-            except dns.resolver.NoAnswer:
-                response.append(f'{bcolors.FAIL}{bcolors.BOLD}{recordType} Record not existing.{bcolors.ENDC}\n')
-                responseOutput.append(f'{recordType} Record not existing.\n')
-
-    except dns.resolver.NXDOMAIN:
-        print(f'{bcolors.FAIL}{bcolors.BOLD}{userInput} does not existing.{bcolors.ENDC}')
-    except dns.rdatatype.UnknownRdatatype:
-        print(f'{bcolors.FAIL}{bcolors.BOLD}Error in your record statement.{bcolors.ENDC}')
-    except dns.resolver.NoResolverConfiguration:
-        print(f'{bcolors.FAIL}{bcolors.BOLD}No NS found or no internet connection.{bcolors.ENDC}')
-    
-    
-    if outputBool:
-        responseOutput.insert(0, '\n#----------------#\n')
-        responseOutput.extend('#----------------#\n')
-        outputFunction(list_to_string(responseOutput))    
-    
-    return(list_to_string(response))
-
-
-def reverseLookup(ipAddress):
-    print(f'\n{bcolors.WARNING}[+] DNS Reverse Lookup...{bcolors.ENDC}')
-    dnsNames = []
-    dnsNamesOutput = []
-    
-    try:
-        for ips in ipAddress:
-            names = dns.reversename.from_address(ips)
-            dnsNames.append(f'{bcolors.OKGREEN}{bcolors.BOLD}Reverse Lookup: {str(dns.resolver.resolve(names, "PTR")[0])}{bcolors.ENDC}\n')
-            dnsNamesOutput.append(f'Reverse DNS Lookup: {str(dns.resolver.resolve(names, "PTR")[0])}\n')
-    except dns.resolver.NXDOMAIN:
-        print(f'{bcolors.FAIL}{bcolors.BOLD}{names} does not existing.{bcolors.ENDC}')
-        dnsNamesOutput.append(f'{names} does not existing.\n')
-    
-    
-    if outputBool:
-        dnsNamesOutput.insert(0, '\n#----------------#\n')
-        dnsNamesOutput.extend('#----------------#\n')
-        outputFunction(list_to_string(dnsNamesOutput))    
-    
-    return(list_to_string(dnsNames))
-
-
-def subdomainEnumeration(targetDomain):
-    print(f'\n{bcolors.WARNING}[+] Subdomain Enumeration started...{bcolors.ENDC}')
-    list = []
-    newList = []
-    listOutput = []
-
-    with open(f'{os.getcwd()}/../lists/subdomains.txt', 'r') as file:
-        name = file.read()
-        subDomains = name.splitlines()
-
-    def enumeration(subdomains):
-        try:
-            ipValue = dns.resolver.resolve(f'{subdomains.lower()}.{targetDomain}', 'A')
-            if ipValue:
-                list.append(f'{subdomains.lower()}.{targetDomain}')
-                for x in list:
-                    if x not in newList: #We check for duplicates
-                        newList.append(x)
-                        print(f'{bcolors.OKGREEN}{bcolors.BOLD}https://{subdomains.lower()}.{targetDomain}{bcolors.ENDC}')
-                        #time.sleep(.01)
-                    else:
-                        pass
-        except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.resolver.NoNameservers, dns.name.EmptyLabel):
-            pass
-        except KeyboardInterrupt:
-            print(f'{bcolors.FAIL}{bcolors.BOLD}\nEnumeration canceled.{bcolors.ENDC}')
-            executor.shutdown()
-
-    with concurrent.futures.ThreadPoolExecutor() as executor:
-        executor.map(enumeration, subDomains)
-
-    if outputBool:   
-        listOutput.insert(0, '\n#----------------#\n')
-        listOutput.extend('#----------------#\n')
-        outputFunction(list_to_string(newList))
-
-
 def mapDnsRecords(userInput, depth=0):
     dnsRecordTypes = ['A', 'AAAA', 'NS', 'CNAME', 'TXT', 'SOA', 'PTR', 'MX', 'SRV']
     server = []
@@ -350,11 +235,11 @@ def reverseAsnLookup(asn):
 def outputFunction(function):
     if os.path.exists('results.txt'):
         f = open('results.txt', 'a')
-        f.write(function)
+        f.write('\n#----------------#\n' + function + '#----------------#\n')
         f.close()
     else:
         f = open('results.txt', 'w+')
-        f.write(function)
+        f.write('\n#----------------#\n' + function + '#----------------#\n')
         f.close()
 
 
@@ -391,6 +276,7 @@ def outputFunction(function):
     #----------------- Argument Parsing -----------------#  
     
     parser = ArgumentParser()
+    
     parser.add_argument('-v', '--version', action='version', version='V0.3-alpha')
     parser.add_argument('-d', '--domain', help='Target Domain to search for.')
     parser.add_argument('-a', '--all', help='Find all DNS Records.', action='store_true')
@@ -400,10 +286,12 @@ def outputFunction(function):
     parser.add_argument('-rasn', '--rasn', help='Reverse ASN Lookup. Shows you the BGP prefixes using an ASN. Requires the ASN Database first.', nargs='+')
     parser.add_argument('-z', '--zone-transfer', help='Attempts a zone transfer attack.', action='store_true')
     parser.add_argument('-i', '--ip-address', help='Reverse DNS Lookup. You can also put multiple IP addresses.', nargs='+')
-    parser.add_argument('-sd', '--subdomains', help='Basic subdomain enumeration.', action='store_true')
+    parser.add_argument('-sd', '--subdomains', help='Subdomain brute force using a provided Wordlist. Use this only if you cannot use the "-sdo" argument.', action='store_true')
+    parser.add_argument('-sdo', '--subdomains-online', help='Subdomain enumeration which uses free online services. Works very fast.', action='store_true')
     parser.add_argument('-m', '--map', help='Attack surface mapping.', action='store_true')
     parser.add_argument('-s', '--scanning', help='NMAP integration for port scanning & service detection. Works from port 15 up to 450. It needs NMAP to be installed on your system.', action='store_true')
     parser.add_argument('-o', '--output', help='Save results in current directory.', action='store_true')
+
     parser.epilog = 'Example: python3 dns.py -d root.security -r TXT A AAAA -z'
 
     args = parser.parse_args()
@@ -415,25 +303,37 @@ def outputFunction(function):
         if args.domain is not None:
             pass
 
+
         if args.output:         #New output Argument. This will be improved over time and it is currently in testing phase.
                outputBool = True       
         
+
         if args.domain is not None and args.all:
             if domainSanitazation.search(args.domain):
-                print(findAllDnsRecords(args.domain))
+                print(f'\n{bcolors.WARNING}[+] Finding all DNS Records...{bcolors.ENDC}')
+                if outputBool:
+                    outputFunction(list_to_string(dnsEnumeration.findAllDnsRecords(args.domain)))
+                else:
+                    dnsEnumeration.findAllDnsRecords(args.domain)             
             else:
                 print(f'{bcolors.FAIL}{bcolors.BOLD}Invalid input detected.{bcolors.ENDC}')
         elif args.domain is None and args.all:
             parser.error('-d / --domain is required.')
         
+
         if args.domain is not None and args.record is not None:
             if domainSanitazation.search(args.domain):
-                print(findSpecificRecord(args.domain, args.record))
+                print(f'\n{bcolors.WARNING}[+] Finding {" ".join(args.record)} Records...{bcolors.ENDC}')
+                if outputBool:
+                    outputFunction(list_to_string(dnsEnumeration.findSpecificRecord(args.domain, args.record)))
+                else:
+                    dnsEnumeration.findSpecificRecord(args.domain, args.record)
             else:
                 print(f'{bcolors.FAIL}{bcolors.BOLD}Invalid input detected.{bcolors.ENDC}')
         elif args.domain is None and args.record is not None:
             parser.error('-d / --domain is required.')
         
+
         if args.zone_transfer and args.domain is not None:
             if domainSanitazation.search(args.domain):
                 print(zoneTransfer(args.domain))
@@ -442,22 +342,22 @@ def outputFunction(function):
         elif args.zone_transfer and args.domain is None:
             parser.error('-d / --domain is required.')
 
-        #----------------- Function with Process -----------------#
+
+        #----------------- Function with Threads -----------------#
         
         if args.subdomains and args.domain is not None:
             if domainSanitazation.search(args.domain):
                 try:
-                    #start = time.perf_counter()
-                    subdomainEnumeration(args.domain)
-                    #stop = time.perf_counter()
-                    #print(f'Task completed in {round(stop - start, 2)} seconds.')
-       
+                    if outputBool:
+                        outputFunction(list_to_string(bruteForceSubdomains.subdomainEnumeration(args.domain)))
+
+                    else:
+                        bruteForceSubdomains.subdomainEnumeration(args.domain)
+
                 except KeyboardInterrupt:
                     print(f'{bcolors.FAIL}{bcolors.BOLD}\nEnumeration canceled.{bcolors.ENDC}')
-
                 except dns.resolver.NoNameservers:
-                    pass
-                
+                    pass 
                 except dns.resolver.NoResolverConfiguration:
                     print(f'{bcolors.FAIL}{bcolors.BOLD}No NS found or no internet connection.{bcolors.ENDC}')
             
@@ -467,6 +367,22 @@ def outputFunction(function):
         elif args.subdomains and args.domain is None:
             parser.error('-d / --domain is required.') 
 
+        #----------------- Function with Threads -----------------#
+
+        if args.subdomains_online and args.domain is not None:
+            print(f'\n{bcolors.WARNING}[+] Subdomain enumeration started for {args.domain}...{bcolors.ENDC}')
+            try:
+                if outputBool: 
+                    outputFunction(list_to_string(onlineSubdomains.main(args.domain)))
+                else:
+                    onlineSubdomains.main(args.domain)
+
+            except KeyboardInterrupt:
+                print(f'{bcolors.FAIL}{bcolors.BOLD}\nEnumeration canceled.{bcolors.ENDC}')
+        
+        elif args.subdomains_online and args.domain is None:
+            parser.error('-d / --domain is required.')
+
         #---------------------------------------------------------# 
 
         if args.map and args.domain is not None:
@@ -524,7 +440,11 @@ def outputFunction(function):
         #----------------- Arguments where DOMAIN is NOT requried -----------------#
 
         if args.ip_address and args.domain is None:
-            print(reverseLookup(args.ip_address))
+            print(f'\n{bcolors.WARNING}[+] DNS Reverse Lookup...{bcolors.ENDC}')
+            if outputBool:
+                outputFunction(list_to_string(dnsEnumeration.reverseLookup(args.ip_address)))
+            else:
+                dnsEnumeration.reverseLookup(args.ip_address)
 
         if args.rasn:
             if os.path.exists('../lists/asn_db.txt'): 
diff --git a/src/requirements.txt b/src/requirements.txt
index 7f4e541..dbfb0e9 100644
--- a/src/requirements.txt
+++ b/src/requirements.txt
@@ -2,3 +2,4 @@ dnspython==2.4.2
 pyasn==1.6.2
 python_nmap==0.7.1
 Requests==2.31.0
+beautifulsoup4==4.12.2
\ No newline at end of file