Knock for Subdomain Enumeration and DNS Recon

Knock for Subdomain Enumeration and DNS Reconnaissance

Knock is a Python-based subdomain enumeration tool that helps security professionals discover subdomains associated with a target domain. It uses wordlists to identify potential subdomains and supports DNS-related checks that can help map a domain’s exposed infrastructure.

The tool was designed to detect potential DNS zone transfer issues and handle wildcard DNS records during enumeration. The original version also supported retrieving subdomain information from VirusTotal through an API key configured in its settings file. Because Knock has multiple versions and its original installation instructions may be outdated, check the repository documentation before installing it on a modern system.

Key Features of Knock

• Subdomain enumeration: Tests candidate subdomains using a supplied or default wordlist.
• Wildcard DNS handling: Helps reduce misleading results caused by wildcard DNS records.
• DNS checks: Includes options for resolving domain names and IP addresses. DNS zone transfer checks depend on the version and its supported features.
• VirusTotal integration: Historical versions support querying VirusTotal for additional subdomain information when an API key is configured.
• Report export: Supported versions can save scan results in JSON or CSV format for later review.
• Custom wordlists: Lets testers supply a wordlist suited to the target environment.

How to Install Knock

Knock’s original repository provides a Python-based installation workflow. First, install Git and Python tools if they are not already available. Then clone the project and review its current requirements.

git clone https://github.com/guelfoweb/knock.git
cd knock

Older releases used a setup script and the dnspython package. The original instructions included commands such as the following, but these may not work with current Python versions or newer packaging standards.

sudo apt-get install python-dnspython
sudo python setup.py install

Prefer a virtual environment and the installation method documented by the repository version you choose. Avoid running legacy installation commands with elevated privileges unless you understand what they change.

Project repository: Knock on GitHub.

Basic Knock Usage

After installation, check the available options for your installed version:

knockpy --help

The original Knock documentation shows a basic scan using a domain name:

knockpy example.com

Replace example.com with a domain you own or are explicitly authorized to assess. If your version supports a custom wordlist, specify its path with the documented wordlist option.

knockpy example.com -w wordlist.txt

Older releases also documented JSON and CSV output options. For example:

knockpy example.com --json
knockpy -c example.com

Option names and behavior can vary between releases. Run the help command first and confirm that your installed version supports each flag before using it in a workflow.

Configure VirusTotal Support

Some historical versions of Knock allow VirusTotal lookups through an API key stored in knockpy/config.json. If this feature is available in your release, obtain an API key from VirusTotal and follow the repository’s configuration instructions.

Keep API keys private, avoid committing configuration files containing credentials to public repositories, and review the service’s usage limits and terms before running queries.

Use Knock in an Authorized Reconnaissance Workflow

Subdomain enumeration can help security teams identify forgotten test environments, exposed development systems, and assets missing from an organization’s inventory. Validate discovered names before treating them as active assets, since DNS records can be stale or point to third-party infrastructure.

For broader reconnaissance, see our guide to website OSINT tools and techniques for reconnaissance. Use Knock only against domains you own or have permission to test, and avoid intrusive follow-up activity without explicit authorization.