Find out subdomains

One way of finding out subdomains are wordlists. Knockpy offers exactly this possibility! It is written in Python, easy to install and to use. The usage of own wordlists is possible, too. The output displayed in the terminal and saved in CSV file.


  • Python installed


# install with pip
$ sudo pip install


# usage with internal wordlist
$ knockpy

# usage with own wordlist
$ knockpy -w wordlist.txt

# resolve domain name
$ knockpy -r

# check zone transfer
$ knockpy -r