Knock is a Python-based subdomain enumeration tool that helps security professionals discover subdomains associated with a target domain. It uses wordlists to identify potential subdomains and supports DNS-related checks that can help map a domain’s exposed infrastructure.
The tool was designed to detect potential DNS zone transfer issues and handle wildcard DNS records during enumeration. The original version also supported retrieving subdomain information from VirusTotal through an API key configured in its settings file. Because Knock has multiple versions and its original installation instructions may be outdated, check the repository documentation before installing it on a modern system.
Knock’s original repository provides a Python-based installation workflow. First, install Git and Python tools if they are not already available. Then clone the project and review its current requirements.
git clone https://github.com/guelfoweb/knock.git cd knock
Older releases used a setup script and the dnspython package. The original instructions included commands such as the following, but these may not work with current Python versions or newer packaging standards.
sudo apt-get install python-dnspython sudo python setup.py install
Prefer a virtual environment and the installation method documented by the repository version you choose. Avoid running legacy installation commands with elevated privileges unless you understand what they change.
Project repository: Knock on GitHub.
After installation, check the available options for your installed version:
knockpy --help
The original Knock documentation shows a basic scan using a domain name:
knockpy example.com
Replace example.com with a domain you own or are explicitly authorized to assess. If your version supports a custom wordlist, specify its path with the documented wordlist option.
knockpy example.com -w wordlist.txt
Older releases also documented JSON and CSV output options. For example:
knockpy example.com --json knockpy -c example.com
Option names and behavior can vary between releases. Run the help command first and confirm that your installed version supports each flag before using it in a workflow.
Some historical versions of Knock allow VirusTotal lookups through an API key stored in knockpy/config.json. If this feature is available in your release, obtain an API key from VirusTotal and follow the repository’s configuration instructions.
Keep API keys private, avoid committing configuration files containing credentials to public repositories, and review the service’s usage limits and terms before running queries.
Subdomain enumeration can help security teams identify forgotten test environments, exposed development systems, and assets missing from an organization’s inventory. Validate discovered names before treating them as active assets, since DNS records can be stale or point to third-party infrastructure.
For broader reconnaissance, see our guide to website OSINT tools and techniques for reconnaissance. Use Knock only against domains you own or have permission to test, and avoid intrusive follow-up activity without explicit authorization.
A data protection platform is a unified system that helps organizations discover, classify, monitor, and…
AI companies operating in or around Switzerland face a compliance challenge that most legal teams…
Two major data privacy laws now govern how organizations handle personal data across Europe; the…
This cheat sheet covers the essential Kali Linux commands every pentester and ethical hacker uses…
When I first started learning malware analysis and reverse engineering, I thought the hardest part…
Both git fetch and git pull talk to a remote repository, but they do very different things to your…