Recon
Pull known subdomains from Chaos DB
Go client for ProjectDiscovery Chaos DB subdomain lookups.
overview
What chaos-client does
chaos-client calls the ProjectDiscovery Chaos DB API. Pass a root with -d and authenticate with -key. The response is hostnames Chaos already cataloged. No packets hit the target.
Batch roots with -dL. Prefer -json for structured rows, -count for stats without a full dump, and -silent for hostname-only lines. The node writes a file and a folder you can merge with other passive finders before httpx.
subfinder can include Chaos among many sources. chaos-client hits Chaos alone. Merge, dedupe, then probe with httpx. A listed name is not a live host.
use cases
Where chaos-client fits
Pull known subdomains passively
Query Chaos DB for a domain to retrieve subdomains it has already cataloged, with no traffic sent to the target.
Add a source to a discovery pipeline
Combine chaos-client output with other passive finders, dedupe the names, and feed the union to a prober for fuller coverage.
Sweep many domains at once
Pass a file of domains so a single run enumerates subdomains across an entire portfolio of roots.
Gauge a target's footprint size
Use count mode to report how many subdomains Chaos knows for a domain before committing to a deeper scan.
reference
chaos-client inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to search for subdomains |
| domain-list | FILE | -dL | File containing domains to search for subdomains |
| key | STRING | -key | Chaos key for API |
| json | BOOLEAN | -json | Print output as json |
| count | BOOLEAN | -count | Show statistics for the specified domain |
| silent | BOOLEAN | -silent | Make the output silent |
| verbose | BOOLEAN | -verbose | Verbose |
Showing key inputs. chaos-client exposes 8 inputs in total.
Full flag reference (8 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| key | STRING | -key | Chaos key for API |
| json | BOOLEAN | -json | Print output as json |
| count | BOOLEAN | -count | Show statistics for the specified domain |
| domain | STRING | -d | Domain to search for subdomains |
| silent | BOOLEAN | -silent | Make the output silent |
| verbose | BOOLEAN | -verbose | Verbose |
| domain-list | FILE | -dL | File containing domains to search for subdomains |
| disable-update-check | BOOLEAN | -disable-update-check | disable automatic chaos update check |
example
Run chaos-client
# chaos-client: passive Chaos DB lookup, quiet hostname listchaos-client -d example.com -key "$CHAOS_KEY" -silentapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comgrafana.example.comwww.example.comguidance
Choosing chaos-client
Use chaos-client early in passive subdomain discovery when you want a direct Chaos DB pull. Pair with other finders for coverage. Follow with httpx; this node lists names only.
subfinder
Queries many passive sources at once, including Chaos. Prefer subfinder for breadth; chaos-client for a single direct source.
amass
Deeper OSINT with active options. chaos-client stays a narrow API lookup.
assetfinder
Lightweight passive finder over other sources. Combine both to widen coverage.
faq
chaos-client questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run chaos-client yourself
A domain feeds chaos-client, which pulls known subdomains from Chaos DB and passes them to httpx so only the live names land as output.
Facts on this page come from the live Trickest tool library.