loading
Loading content
loading
Recon
Passive subdomain enumeration with optional resolve and HTTP checks.
overview
findomain takes --target and writes FILE and FOLDER subdomain results from certificate transparency and other passive sources.
Enable --resolved and --ip to keep answering names with addresses. Add --http-status or --pscan when you want HTTP checks or a port range in the same run. Supply --wordlist to enable bruteforce.
Trickest runs findomain as a managed Recon node. Prefer subfinder for a light passive-only pull, or amass when you need deeper active correlation. findomain sits between them with built-in resolve and optional port scan.
use cases
Run findomain with --target to pull subdomains from certificate transparency and passive sources in one pass, then write them for the rest of the workflow.
Enable --resolved to keep only subdomains that resolve, record addresses with --ip, and run --http-status so downstream stages start from hosts that answer.
Supply --wordlist to bruteforce additional names and turn on --pscan over a chosen port range to map exposed services alongside discovered subdomains.
Import subdomains with --import-subdomains, exclude noisy sources or string patterns, and feed the cleaned list into a probing and scanning pipeline.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-host | STRING | --target | Target host. |
| subdomains | FILE | --file | Use a list of subdomains writen in a file as input. |
| resolved | BOOLEAN | --resolved | Show/write only resolved subdomains. |
| show-resolved-ip | BOOLEAN | --ip | Show/write the ip address of resolved subdomains. |
| http-status | BOOLEAN | --http-status | Check the HTTP status of subdomains. |
| pscan | BOOLEAN | --pscan | Enable port scanner. |
| wordlist | FILE | --wordlist | Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode. |
| exclude-sources | STRING | --exclude-sources | Exclude sources from searching subdomains in. |
Showing key inputs. findomain exposes 39 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| pscan | BOOLEAN | --pscan | Enable port scanner. |
| quiet | BOOLEAN | --quiet | Remove informative messages but show fatal errors or subdomains not found message. |
| aempty | BOOLEAN | --aempty | Send alert to webhooks still when no new subdomains have been found. |
| filter | STRING | --filter | Filter subdomains containing specifics strings. |
| jobname | STRING | --jobname | Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option. |
| resolved | BOOLEAN | --resolved | Show/write only resolved subdomains. |
| wordlist | FILE | --wordlist | Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode. |
| ipv6-only | BOOLEAN | --ipv6-only | Perform a IPv6 lookup only |
| last-port | STRING | --lport | Last port to scan. Default 1000. |
| randomize | BOOLEAN | --randomize | Enable randomization when reading targets from files. |
| resolvers | FILE | --resolvers | Path to a file containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used. |
| enable-dot | BOOLEAN | --enable-dot | Enable DNS over TLS for resolving subdomains IPs. |
| no-monitor | BOOLEAN | --no-monitor | Disable monitoring mode while saving data to database. |
| no-resolve | BOOLEAN | --no-resolve | Disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots. |
| rate-limit | STRING | --rate-limit | Set the rate limit in seconds for each target during enumeration. |
| subdomains | FILE | --file | Use a list of subdomains writen in a file as input. |
| as-resolver | BOOLEAN | --as-resolver | Use Findomain as resolver for a list of domains in a file. |
| config-file | FILE | --config | Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml. |
| http-status | BOOLEAN | --http-status | Check the HTTP status of subdomains. |
| target-host | STRING | --target | Target host. |
| user-agents | FILE | --ua | Path to file containing user agents strings. |
| http-timeout | STRING | --http-timeout | Value in seconds for the HTTP Status check of subdomains. Default 5 |
| initial-port | STRING | --iport | Initial port to scan. Default 0. |
| no-wildcards | BOOLEAN | --no-wildcards | Disable wilcard detection when resolving subdomains. |
| verbose-mode | BOOLEAN | --verbose | Enable verbose mode (useful to debug problems). |
| postgres-host | STRING | --postgres-host | Postgresql host. |
| postgres-port | STRING | --postgres-port | Postgresql port. |
| postgres-user | STRING | --postgres-user | Postgresql username. |
| query-jobname | STRING | --query-jobname | Extract all the subdomains from the database where the job name is the specified using the jobname option. |
| chrome-sandbox | BOOLEAN | --sandbox | Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option. |
| monitoring-mde | BOOLEAN | --monitoring-flag | Activate Findomain monitoring mode |
| query-database | BOOLEAN | --query-database | Query the findomain database to search subdomains that have already been discovered. |
| exclude-sources | STRING | --exclude-sources | Exclude sources from searching subdomains in. [possible values: certspotter, crtsh, virustotal, sublist3r, facebook, spyse, bufferover, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer,archiveorg, c99, ctsearch] |
| show-resolved-ip | BOOLEAN | --ip | Show/write the ip address of resolved subdomains. |
| import-subdomains | FILE | --import-subdomains | Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import. |
| postgres-database | STRING | --postgres-database | Postgresql database. |
| postgres-password | STRING | --postgres-password | Postgresql password. |
| external-subdomains | BOOLEAN | --external-subdomains | Get external subdomains with amass and subfinder |
| exclude-subdomain-strings | STRING | --exclude | Exclude subdomains containing specifics strings. |
example
# findomain: passive enum, resolved names only, with IPsfindomain --target example.com --resolved --ip --quietapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comcdn.example.comwww.example.comguidance
Use findomain when you want subdomain enumeration plus resolve, HTTP status, or an optional port scan in one node. For passive-only coverage pick subfinder. For deeper passive and active mapping pick amass.
Passive subdomain discovery across many sources. Faster and source-focused, without built-in resolve, port scan, or HTTP check.
Deeper passive and active enumeration with richer correlation. Heavier to run than findomain.
Minimal passive subdomain finder. Useful as an extra source to feed findomain via --import-subdomains.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A target feeds Findomain, which enumerates and resolves its subdomains and passes the live hosts to httpx before they land as a queryable output.
Facts on this page come from the live Trickest tool library.