-f to-check.txt is the path to your list of subdomains to check. One subdomain per line. Required.
-t is the number of threads to use. (Default: 10)
-a skips CNAME check and sends requests to every URL. (Default: false, but Highly recommended.)
-timeout is the number seconds to wait before timing out a check (Default: 10).
-o results.txt is a filename to output results to. If the file ends with .json, subtake will automatically switch to JSON format.
-v enables verbose mode. Displays all checks including not vulnerable URLs.
-c Path to file containing JSON fingerprint configuration. (Default: ./fingerprints.json)
-ssl enforces HTTPS requests which may return a different set of results and increase accuracy.
sonar.sh can be used first to gather a list of CNAMEs collected by Rapid7/scan.io’s Project Sonar. This list can then be passed into subtake to return subdomains not in use. sonar.sh is based off of scanio.sh.
fingerprints.json can be modified to add or remove hosted platforms to probe for. Many obscure platforms are included, and removing fingerprints for services that are uninteresting to you can speed up the scan.