Automates https://subdomainfinder.c99.nl | Usage: python3 c99-nl.py <domain.com> | Requirements: pip3 install bs4

c99-nl.py

#!/usr/bin/env python3
# v.0.2 | twitter.com/si9int
import requests, sys
from bs4 import BeautifulSoup as bs

domain = sys.argv[1]
subdomains = []

def get_csrf_params():
    csrf_params = {}
    
    data = requests.get('https://subdomainfinder.c99.nl/').text
    html = bs(data, 'html.parser').find('div', {'class' : 'input-group'})

    for c in html.find_all('input'):
        try:
            csrf_params[c.get('name')] = c.get('value')
        except:
            pass
    
    return csrf_params

params = get_csrf_params()

# Additional options
params['scan_subdomains'] = ''
params['domain'] = domain
params['privatequery'] = 'on'

data = requests.post('https://subdomainfinder.c99.nl/', data=params).text
html = bs(data, 'html.parser').find('table', {'id' : 'result_table'})

for tr in html.find_all('tr'):
    try:
        subdomains.append(tr.find('a').text)
    except:
        pass
    
for s in subdomains:
    print(s)