findomain
The complete solution for domain recognition. Supports screenshotting, port scan, HTTP check, data import from other tools, subdomain monitoring.
Details
Category: Recon
Publisher: trickest-mhmdiaa
Created Date: 2/5/2022
Container: quay.io/trickest/findomain:5.1.1
Source URL: https://github.com/Findomain/Findomain
Parameters
Command:
--pscan - Enable port scanner.Command:
--quiet - Remove informative messages but show fatal errors or subdomains not found message.Command:
--aempty - Send alert to webhooks still when no new subdomains have been found.Command:
--filter - Filter subdomains containing specifics strings.Command:
--jobname - Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option.Command:
--resolved - Show/write only resolved subdomains.Command:
--wordlist - Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode.Command:
--ipv6-only - Perform a IPv6 lookup onlyCommand:
--lport - Last port to scan. Default 1000.Command:
--randomize - Enable randomization when reading targets from files.Command:
--resolvers - Path to a file containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used.Command:
--enable-dot - Enable DNS over TLS for resolving subdomains IPs.Command:
--no-monitor - Disable monitoring mode while saving data to database.Command:
--no-resolve - Disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots.Command:
--rate-limit - Set the rate limit in seconds for each target during enumeration.Command:
--file - Use a list of subdomains writen in a file as input.Command:
--as-resolver - Use Findomain as resolver for a list of domains in a file.Command:
--config - Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml.Command:
--http-status - Check the HTTP status of subdomains.Command:
--target - Target host.Command:
--ua - Path to file containing user agents strings.Command:
--http-timeout - Value in seconds for the HTTP Status check of subdomains. Default 5Command:
--iport - Initial port to scan. Default 0.Command:
--no-wildcards - Disable wilcard detection when resolving subdomains.Command:
--verbose - Enable verbose mode (useful to debug problems).Command:
--postgres-host - Postgresql host.Command:
--postgres-port - Postgresql port.Command:
--postgres-user - Postgresql username.Command:
--query-jobname - Extract all the subdomains from the database where the job name is the specified using the jobname option.Command:
--sandbox - Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option.Command:
--monitoring-flag - Activate Findomain monitoring modeCommand:
--query-database - Query the findomain database to search subdomains that have already been discovered.Command:
--exclude-sources - Exclude sources from searching subdomains in. [possible values: certspotter, crtsh, virustotal, sublist3r, facebook, spyse, bufferover, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer,archiveorg, c99, ctsearch]Command:
--ip - Show/write the ip address of resolved subdomains.Command:
--import-subdomains - Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import.Command:
--postgres-database - Postgresql database.Command:
--postgres-password - Postgresql password.Command:
--external-subdomains - Get external subdomains with amass and subfinderCommand:
--exclude - Exclude subdomains containing specifics strings.