loading
Loading content
loading
Recon
A Go client that pulls subdomains from the Chaos DB API.
overview
chaos-client is a thin Go client over ProjectDiscovery's Chaos DB, a continuously updated dataset of subdomains gathered from public sources and bug bounty programs. Give it a domain and an API key and it returns the subdomains Chaos already knows about, without sending a packet to the target. That makes it one of the quietest and quickest ways to seed an attack-surface map.
Because it is passive and API-backed, a query finishes in seconds even for large domains. JSON output keeps the results structured, count mode reports how many entries exist, and a domain-list file lets you sweep many roots in one run.
On Trickest, chaos-client is a Recon node that takes a domain and writes a file and a folder of results. Treat it as one source among several: run it alongside other passive finders, merge and dedupe the names, then hand the combined list to a prober like httpx to find which subdomains are live.
use cases
Query Chaos DB for a domain to retrieve subdomains it has already cataloged, with no traffic sent to the target.
Combine chaos-client output with other passive finders, dedupe the names, and feed the union to a prober for fuller coverage.
Pass a file of domains so a single run enumerates subdomains across an entire portfolio of roots.
Use count mode to report how many subdomains Chaos knows for a domain before committing to a deeper scan.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to search for subdomains |
| domain-list | FILE | -dL | File containing domains to search for subdomains |
| key | STRING | -key | Chaos key for API |
| json | BOOLEAN | -json | Print output as json |
| count | BOOLEAN | -count | Show statistics for the specified domain |
| silent | BOOLEAN | -silent | Make the output silent |
| verbose | BOOLEAN | -verbose | Verbose |
Showing key inputs. chaos-client exposes 8 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| key | STRING | -key | Chaos key for API |
| json | BOOLEAN | -json | Print output as json |
| count | BOOLEAN | -count | Show statistics for the specified domain |
| domain | STRING | -d | Domain to search for subdomains |
| silent | BOOLEAN | -silent | Make the output silent |
| verbose | BOOLEAN | -verbose | Verbose |
| domain-list | FILE | -dL | File containing domains to search for subdomains |
| disable-update-check | BOOLEAN | -disable-update-check | disable automatic chaos update check |
example
# chaos-client: passive Chaos DB lookup, quiet hostname listchaos-client -d example.com -key "$CHAOS_KEY" -silentapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comgrafana.example.comwww.example.comguidance
Use chaos-client as one passive source at the start of subdomain discovery. It returns only what Chaos DB already has, so pair it with other finders for coverage and never rely on it alone. It lists names, it does not test them, so follow it with httpx.
Queries many passive sources at once, including Chaos. Use it for broad coverage, chaos-client for a single direct source.
Deeper OSINT with active options. chaos-client is a fast, narrow API lookup.
Lightweight passive finder over other sources. Combine both to widen the net.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
A domain feeds chaos-client, which pulls known subdomains from Chaos DB and passes them to httpx so only the live names land as output.
Facts on this page come from the live Trickest tool library.