> ## Documentation Index
> Fetch the complete documentation index at: https://trickest.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Enumerate Hostnames via OSINT Sources
> Enumerate subdomains and hostnames passively using OSINT data sources
export const ModuleOverview = ({category, inputs, outputs, author, createdDate, iframeUrl, long_description}) =>
{category}
Created by
{author}
Last updated
{new Date(createdDate).toLocaleDateString()}
{long_description}
Input Parameters
{Object.entries(inputs).map(([key, value]) =>
{value.description}
)}
Outputs
{outputs.map((output, index) =>
{output}
)}
;
# Enumerate Hostnames via OSINT Sources
## Description
Enumerate subdomains passively using carefully chosen and tuned data sources to balance speed and thoroughness. It can also identify extra root domains and associated hostnames linked to the specified target domains, even if they aren’t their subdomains. You don't need any 3rd-party API keys to use this module, but if you choose to query more data sources, you can give it that extra boost.
## Features
* Carefully **curated and optimized data sources** ensure a balance between speed and comprehensiveness.
* Can enumerate **thousands of domains** simultaneously.
* Capable of identifying not only subdomains but also **additional hostnames and root domains** associated with the target organization.
* Functional **without any API keys**, but offers the option to provide them to improve results.
* Includes a **detailed output file** showing which data sources found each subdomain, helping you learn more.
## Inputs
### Required
* **domains:** a list of domain names
```
example.com
```
### Optional
* **source-configuration**: YAML file with API keys and data source configuration
```yaml theme={null}
github:
- GITHUB_API_KEY_1
- GITHUB_API_KEY_2
shodan:
- SHODAN_API_KEY
#
# supported sources:
# - alienvault
# - anubis
# - binaryedge
# - bufferover
# - c99
# - censys
# - certspotter
# - chaos
# - chinaz
# - commoncrawl
# - crtsh
# - digitorus
# - dnsdb
# - dnsdumpster
# - dnsrepo
# - fofa
# - fullhunt
# - github
# - hackertarget
# - hunter
# - intelx
# - netlas
# - leakix
# - passivetotal
# - quake
# - rapiddns
# - redhuntlabs
# - robtex
# - securitytrails
# - shodan
# - sitedossier
# - threatbook
# - virustotal
# - waybackarchive
# - whoisxmlapi
# - zoomeyeapi
# - facebook
# - builtwith
```
## Outputs
* **subdomains**: List of discovered subdomains.
```
foo.example.com
bar.example.com
baz.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "foo.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "github"}
{"hostname": "bar.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "shodan"}
{"hostname": "baz.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "waybackarchive"}
```
* **potential-hostnames**: List of related hostnames outside the strict scope.
```
foo.example-internal.com
bar.example-subsidiary.com
baz.example-service-provider.net
```
* **potential-hostname-details**: JSONLines records of potential hostname discovery details.
```json theme={null}
{"hostname": "foo.example-corp.com", "domain_name": "example-corp.com", "data_sources": "osint source", "context": "cloud tls certificate"}
{"hostname": "bar.example-subsidiary.com", "domain_name": "example-subsidiary.com", "data_sources": "osint source", "context": "reverse analytics code search"}
{"hostname": "baz.example-service-provider.net", "domain_name": "example-service-provider.net", "data_sources": "osint source", "context": "certificate transparency"}
```
* **subdomain-wildcards**: List of discovered subdomain wildcards.
```
*.internal.example.com
```
* **subdomain-wildcard-details**: JSONLines records of subdomain wildcard discovery details.
```json theme={null}
{"hostname": "*.internal.example.com", "domain_name": "example.com", "data_source": "osint source", "context": "cloud tls certificate"}
```
* **potential-hostname-wildcards**: List of related hostnames with wildcards outside the strict scope.
```
*.proxy.example-corp.com
```
* **potential-hostname-wildcard-details**: JSONLines records of potential hostname wildcard discovery details.
```json theme={null}
{"hostname": "*.proxy.example-corp.com", "domain_name": "example-corp.com", "data_source": "osint source", "context": "certificate transparency"}
```
**Note**: The `*-details` outputs may contain duplicates if a hostname was discovered through multiple sources.
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Bug fixes
* v1.0.2
* Performance improvements
* v1.0.3
* Improved output efficiency by storing one record per unique hostname from the certificate\_transparency source