Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Recon

Collect related domains without touching the target

Find domains and subdomains potentially related to a given domain.

Agent
Seed an attack-surface mapFind related assets across root domainsFeed a resolve-and-probe pipeline

overview

What assetfinder does

assetfinder seeds attack-surface maps with related domains and subdomains pulled from passive sources such as certificate transparency and public datasets.

Run it first when you want names without sending traffic to the target. Add --subs-only when sibling root domains should stay out of the list.

Trickest provides assetfinder as a managed Recon node. Input a domain or domains file; take FILE and FOLDER names into a resolver and httpx. Prefer subfinder or amass when you need wider source coverage in one pass.

source github.com/tomnomnom/assetfinder

use cases

Where assetfinder fits

Seed an attack-surface map

Run assetfinder on a root domain to get a passive list of related names before any active scanning touches the target.

Find related assets across root domains

Let assetfinder surface domains the organization owns beyond the one you queried, widening scope past a single-domain search.

Feed a resolve-and-probe pipeline

Pass discovered names to a DNS resolver and httpx so the workflow keeps only the subdomains that resolve and answer.

Enumerate many domains at once

Supply a domains file to map several footprints in a single run and write the combined name list for downstream nodes.

reference

assetfinder inputs and flags

3 inputs
NameTypeFlagDescription
domainSTRING·Domain name to find related domains and subdomains for.
domainsFILE·File containing a list of domain names for bulk discovery.
subs-onlyBOOLEAN--subs-onlyOnly include subdomains of the search domain.

Showing key inputs. assetfinder exposes 3 inputs in total.

example

Run assetfinder

assetfinder · command
# subdomains and related domains across rootsassetfinder example.com > assets.txt# restrict output to subdomains of the targetassetfinder --subs-only example.com > subs.txt
sample output
example.comwww.example.comapi.example.commail.example.comblog.example.comdev.example.comexample.netcdn.example.netstatus.example.org

guidance

Choosing assetfinder

Use assetfinder for a passive first pass at related names for a domain. It finds names; it does not resolve or probe them. Follow with a resolver and httpx. Reach for subfinder or amass when you need broader source coverage.

subfinder

Passive subdomain discovery across more sources. assetfinder is lighter and also surfaces related root domains.

amass

Deeper OSINT with active options. Heavier, but maps more of an organization's footprint.

findomain

Cross-platform subdomain finder. A close sibling for a quick passive sweep.

faq

assetfinder questions

--subs-only keeps only subdomains of the domain you queried and drops related root domains. Use it when you want a clean subdomain list. In the Trickest node, toggle the subs-only input.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. bbot

    Modular OSINT recon that chains modules from a seed target.

  4. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  5. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

  6. cloudlist

    List assets from multiple cloud providers in one inventory.

Run assetfinder yourself

A domain feeds assetfinder, which gathers related names passively and passes them to httpx so only the live ones land as output.

Open assetfinder in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.