Knockpy Command Guide

Knockpy is a Python3 tool designed to enumerate subdomains on a target domain through a wordlist. It also checks for zone transfers.

Top 10 Useful Commands

1. Basic Scan

knockpy domain.com

Explanation: Scans using standard internal wordlist.

2. Custom Wordlist

knockpy domain.com -w wordlist.txt

Explanation: Use your own list.

3. Zone Transfer Check

# (Automatic)

Explanation: Knockpy checks for Zone Transfers (AXFR) automatically at start.

4. Save JSON

knockpy domain.com --json

Explanation: Outputs detailed JSON.

5. Scan & CSV

knockpy domain.com --save folder

Explanation: Saves report to a specific folder.

6. Timeout

knockpy domain.com -t 5

Explanation: Set timeout for responses.

7. Check Wildcard

# (Automatic)

Explanation: Checks for wildcard DNS responses to reduce false positives.

8. Resolve IP

# (Default)

Explanation: Always resolves IP and shows server type.

9. Ignore HTTP codes

# (Depends on version args)

Explanation: Often used to ignore 404s.

10. Virustotal

knockpy domain.com --apikey ...

Explanation: (If supported by ver) Can query VT API.

The Most Powerful Command

knockpy domain.com -w subdomains_big.txt --save scan_report

Explanation: Detailed enumeration using a massive wordlist with persistent reporting.