Attack Surface Management
Enumerate Hostnames via OSINT Sources
Enumerate hostnames from passive OSINT sources. No API keys required; optional keys expand sources. Finds related roots, not only subdomains of the target.
What Enumerate Hostnames via OSINT Sources does
Subdomain enumeration starts with what third parties already know. Passive OSINT sources like certificate transparency logs and Internet Archive records surface hostnames for a list of domains without sending any traffic to the target, so they are the safe first pass before DNS brute force or crawling. The module also catches extra root domains and related hostnames the sources link to the same organization, even when they sit outside strict scope.
You feed a domain list. The module reads public records for hostnames third parties already know, plus extra roots those records link to the same organization. It records provenance per name and never sends traffic to the target.
Where it fits in the pipeline
Upstream
A domain list from scope, an asset inventory, or a manual list.
Downstream
Known hostnames into Enumerate Hostnames via DNS Permutations Brute Force and Enumerate Hostnames via Recursive DNS Brute Force. Live check through Probe for Web Servers. Extra roots you accept can re-enter as domains. Generate Custom DNS Wordlists derives lists from the names you keep.
Parallel
Root-domain DNS brute force on the same domains. That wordlists unpublished first-level labels. This reads what third parties already recorded.
When to use this
Nest this first, on a domain list from scope or inventory, before any traffic to the target. Run Enumerate Hostnames via Root Domain DNS Brute Force beside it on the same domains. Then permute and recurse on the known hostnames that come back. Probe for Web Servers next. Enumerate Hostnames via Crawling last, only on live URLs.
Data
The tables this module produces. Sample rows are illustrative.
Hostnames pulled from passive OSINT sources, plus extra roots linked to the same organization.
hostnametext | domain_nametext | initial_assettext | initial_asset_typetext | discovery_methodtext | evidencetext | evidence_typetext | evidence_reproductiontext | |
|---|---|---|---|---|---|---|---|---|
| 1 | api.example.com | example.com | example.com | domain | certificate transparency | crt.sh CT log entry 2026-08-12 | certificate transparency log | https://crt.sh?q=example.com |
| 2 | staging.example.com | example.com | example.com | domain | osint | Internet Archive snapshot 2026-07-30 | web archive | https://web.archive.org/web/*/example.com |
| 3 | partner.example-corp.com | example-corp.com | example.com | domain | osint | Reverse WHOIS link to example.com registrant | whois | https://viewdns.info/reversewhois/ |
How it differs from similar modules
Enumerate Hostnames via OSINT Sources
Artifact class it owns
Names third parties already know
Upstream it needs
domains
Artifact class it owns
Names in HTML, JS, headers of live sites
Upstream it needs
live URLs after probe
Artifact class it owns
Altered spellings of known hostnames
Upstream it needs
known hostnames
Artifact class it owns
First-level names against the apex
Upstream it needs
domains + wordlist
Artifact class it owns
Sub-subdomains of names you already have
Upstream it needs
known hostnames + level-2/3/4 wordlists
questions
Enumerate Hostnames via OSINT Sources questions
Nest Enumerate Hostnames via OSINT Sources in a workflow
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.