Recon
Collect related domains without touching the target
assetfinder is a Go command-line tool by tomnomnom that finds domains and subdomains potentially related to a given domain by querying passive sources such as crt.sh, certspotter, HackerTarget, and the Wayback Machine.
installgo install github.com/tomnomnom/assetfinder@latest
Go · MIT license
overview
What assetfinder does
assetfinder seeds attack-surface maps with related domains and subdomains pulled from passive sources such as certificate transparency and public datasets.
Run it first when you want names without sending traffic to the target. Add --subs-only when sibling root domains should stay out of the list.
Trickest provides assetfinder as a managed Recon node. Input a domain or domains file; take FILE and FOLDER names into a resolver and httpx. Prefer subfinder or amass when you need wider source coverage in one pass.
use cases
Where assetfinder fits
Seed an attack-surface map
Run assetfinder on a root domain to get a passive list of related names before any active scanning touches the target.
Find related assets across root domains
Let assetfinder surface domains the organization owns beyond the one you queried, widening scope past a single-domain search.
Feed a resolve-and-probe pipeline
Pass discovered names to a DNS resolver and httpx so the workflow keeps only the subdomains that resolve and answer.
Enumerate many domains at once
Supply a domains file to map several footprints in a single run and write the combined name list for downstream nodes.
reference
assetfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain name to find related domains and subdomains for. |
| domains | FILE | · | File containing a list of domain names for bulk discovery. |
| subs-only | BOOLEAN | --subs-only | Only include subdomains of the search domain. |
Showing key inputs. assetfinder exposes 3 inputs in total.
example
Run assetfinder
# subdomains and related domains across roots
assetfinder example.com > assets.txt
# restrict output to subdomains of the target
assetfinder --subs-only example.com > subs.txtexample.com
www.example.com
api.example.com
mail.example.com
blog.example.com
dev.example.com
example.net
cdn.example.net
status.example.orgguidance
Choosing assetfinder
Use assetfinder for a passive first pass at related names for a domain. It finds names; it does not resolve or probe them. Follow with a resolver and httpx. Reach for subfinder or amass when you need broader source coverage.
subfinder
Passive subdomain discovery across more sources. assetfinder is lighter and also surfaces related root domains.
amass
Deeper OSINT with active options. Heavier, but maps more of an organization's footprint.
findomain
Cross-platform subdomain finder. A close sibling for a quick passive sweep.
faq
assetfinder questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
cloudlist
List assets from multiple cloud providers in one inventory.
Run assetfinder yourself
A domain feeds assetfinder, which gathers related names passively and passes them to httpx so only the live ones land as output.
Facts on this page come from the live Trickest tool library.