loading
Loading content
loading
Recon
Find domains and subdomains potentially related to a given domain.
overview
assetfinder pulls domains and subdomains tied to a target from passive sources such as certificate transparency, search engines, and public datasets. It sends no traffic to the target, so it maps a footprint quickly and quietly, which makes it a natural first node in an attack-surface workflow.
It does one thing and does it fast. Give it a domain and it returns related names, including assets on other root domains the organization owns, or set --subs-only to keep only the subdomains of the domain you queried.
On Trickest, assetfinder is a Recon node that takes a domain or a file of domains and writes a file and a folder of names. Hand the results to a resolver and an HTTP prober to keep only the names that resolve and respond.
use cases
Run assetfinder on a root domain to get a fast passive list of related names before any active scanning touches the target.
Let assetfinder surface domains the organization owns beyond the one you queried, widening scope to assets a single-domain search would miss.
Pass discovered names to a DNS resolver and httpx so the workflow keeps only the subdomains that resolve and answer.
Supply a file of domains to map several footprints in a single run and write the combined name list for downstream nodes.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain name to find related domains and subdomains for. |
| domains | FILE | · | File containing a list of domain names for bulk discovery. |
| subs-only | BOOLEAN | --subs-only | Only include subdomains of the search domain. |
Showing key inputs. assetfinder exposes 3 inputs in total.
example
# subdomains and related domains across rootsassetfinder example.com > assets.txt# restrict output to subdomains of the targetassetfinder --subs-only example.com > subs.txtexample.comwww.example.comapi.example.commail.example.comblog.example.comdev.example.comexample.netcdn.example.netstatus.example.orgguidance
Use assetfinder for a fast, passive first pass at a domain's related names. It finds names, it does not test them, so follow it with a resolver and httpx. For wider source coverage on a single pass, reach for subfinder or amass.
Passive subdomain discovery across more sources. assetfinder is lighter and also surfaces related root domains.
Deeper OSINT with active options. Slower, but maps more of an organization's footprint.
Fast cross-platform subdomain finder. A close sibling for a quick passive sweep.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
OSINT automation for hackers.
A domain feeds assetfinder, which gathers related names passively and passes them to httpx so only the live ones land as output.
Facts on this page come from the live Trickest tool library.