loading
Loading content
loading
Recon
Go client for ProjectDiscovery Chaos DB subdomain lookups.
overview
chaos-client calls the ProjectDiscovery Chaos DB API. Pass a root with -d and authenticate with -key. The response is hostnames Chaos already cataloged. No packets hit the target.
Batch roots with -dL. Prefer -json for structured rows, -count for stats without a full dump, and -silent for hostname-only lines. The node writes a file and a folder you can merge with other passive finders before httpx.
subfinder can include Chaos among many sources. chaos-client hits Chaos alone. Merge, dedupe, then probe with httpx. A listed name is not a live host.
use cases
Query Chaos DB for a domain to retrieve subdomains it has already cataloged, with no traffic sent to the target.
Combine chaos-client output with other passive finders, dedupe the names, and feed the union to a prober for fuller coverage.
Pass a file of domains so a single run enumerates subdomains across an entire portfolio of roots.
Use count mode to report how many subdomains Chaos knows for a domain before committing to a deeper scan.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to search for subdomains |
| domain-list | FILE | -dL | File containing domains to search for subdomains |
| key | STRING | -key | Chaos key for API |
| json | BOOLEAN | -json | Print output as json |
| count | BOOLEAN | -count | Show statistics for the specified domain |
| silent | BOOLEAN | -silent | Make the output silent |
| verbose | BOOLEAN | -verbose | Verbose |
Showing key inputs. chaos-client exposes 8 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| key | STRING | -key | Chaos key for API |
| json | BOOLEAN | -json | Print output as json |
| count | BOOLEAN | -count | Show statistics for the specified domain |
| domain | STRING | -d | Domain to search for subdomains |
| silent | BOOLEAN | -silent | Make the output silent |
| verbose | BOOLEAN | -verbose | Verbose |
| domain-list | FILE | -dL | File containing domains to search for subdomains |
| disable-update-check | BOOLEAN | -disable-update-check | disable automatic chaos update check |
example
# chaos-client: passive Chaos DB lookup, quiet hostname listchaos-client -d example.com -key "$CHAOS_KEY" -silentapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comgrafana.example.comwww.example.comguidance
Use chaos-client early in passive subdomain discovery when you want a direct Chaos DB pull. Pair with other finders for coverage. Follow with httpx; this node lists names only.
Queries many passive sources at once, including Chaos. Prefer subfinder for breadth; chaos-client for a single direct source.
Deeper OSINT with active options. chaos-client stays a narrow API lookup.
Lightweight passive finder over other sources. Combine both to widen coverage.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds chaos-client, which pulls known subdomains from Chaos DB and passes them to httpx so only the live names land as output.
Facts on this page come from the live Trickest tool library.