loading
Loading content
loading
Recon
Find domains and subdomains potentially related to a given domain.
overview
assetfinder seeds attack-surface maps with related domains and subdomains pulled from passive sources such as certificate transparency and public datasets.
Run it first when you want names without sending traffic to the target. Add --subs-only when sibling root domains should stay out of the list.
Trickest provides assetfinder as a managed Recon node. Input a domain or domains file; take FILE and FOLDER names into a resolver and httpx. Prefer subfinder or amass when you need wider source coverage in one pass.
use cases
Run assetfinder on a root domain to get a passive list of related names before any active scanning touches the target.
Let assetfinder surface domains the organization owns beyond the one you queried, widening scope past a single-domain search.
Pass discovered names to a DNS resolver and httpx so the workflow keeps only the subdomains that resolve and answer.
Supply a domains file to map several footprints in a single run and write the combined name list for downstream nodes.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain name to find related domains and subdomains for. |
| domains | FILE | · | File containing a list of domain names for bulk discovery. |
| subs-only | BOOLEAN | --subs-only | Only include subdomains of the search domain. |
Showing key inputs. assetfinder exposes 3 inputs in total.
example
# subdomains and related domains across rootsassetfinder example.com > assets.txt# restrict output to subdomains of the targetassetfinder --subs-only example.com > subs.txtexample.comwww.example.comapi.example.commail.example.comblog.example.comdev.example.comexample.netcdn.example.netstatus.example.orgguidance
Use assetfinder for a passive first pass at related names for a domain. It finds names; it does not resolve or probe them. Follow with a resolver and httpx. Reach for subfinder or amass when you need broader source coverage.
Passive subdomain discovery across more sources. assetfinder is lighter and also surfaces related root domains.
Deeper OSINT with active options. Heavier, but maps more of an organization's footprint.
Cross-platform subdomain finder. A close sibling for a quick passive sweep.
faq
related
Multi-source subdomain discovery; hand names to httpx.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
Multi-purpose DNS toolkit for resolution, record queries, and wordlist brute force.
A domain feeds assetfinder, which gathers related names passively and passes them to httpx so only the live ones land as output.
Facts on this page come from the live Trickest tool library.