Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Recon

Enumerate and resolve subdomains in one pass

Passive subdomain enumeration with optional resolve and HTTP checks.

Agent
Enumerate a domain's subdomain surfaceResolve and confirm live hostsExtend enumeration with bruteforce and ports

overview

What findomain does

findomain takes --target and writes FILE and FOLDER subdomain results from certificate transparency and other passive sources.

Enable --resolved and --ip to keep answering names with addresses. Add --http-status or --pscan when you want HTTP checks or a port range in the same run. Supply --wordlist to enable bruteforce.

Trickest runs findomain as a managed Recon node. Prefer subfinder for a light passive-only pull, or amass when you need deeper active correlation. findomain sits between them with built-in resolve and optional port scan.

source github.com/Findomain/Findomain

use cases

Where findomain fits

Enumerate a domain's subdomain surface

Run findomain with --target to pull subdomains from certificate transparency and passive sources in one pass, then write them for the rest of the workflow.

Resolve and confirm live hosts

Enable --resolved to keep only subdomains that resolve, record addresses with --ip, and run --http-status so downstream stages start from hosts that answer.

Extend enumeration with bruteforce and ports

Supply --wordlist to bruteforce additional names and turn on --pscan over a chosen port range to map exposed services alongside discovered subdomains.

Merge and filter results from other tools

Import subdomains with --import-subdomains, exclude noisy sources or string patterns, and feed the cleaned list into a probing and scanning pipeline.

reference

findomain inputs and flags

39 inputs
NameTypeFlagDescription
target-hostSTRING--targetTarget host.
subdomainsFILE--fileUse a list of subdomains writen in a file as input.
resolvedBOOLEAN--resolvedShow/write only resolved subdomains.
show-resolved-ipBOOLEAN--ipShow/write the ip address of resolved subdomains.
http-statusBOOLEAN--http-statusCheck the HTTP status of subdomains.
pscanBOOLEAN--pscanEnable port scanner.
wordlistFILE--wordlistWordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode.
exclude-sourcesSTRING--exclude-sourcesExclude sources from searching subdomains in.

Showing key inputs. findomain exposes 39 inputs in total.

Full flag reference (39 inputs)
NameTypeFlagDescription
pscanBOOLEAN--pscanEnable port scanner.
quietBOOLEAN--quietRemove informative messages but show fatal errors or subdomains not found message.
aemptyBOOLEAN--aemptySend alert to webhooks still when no new subdomains have been found.
filterSTRING--filterFilter subdomains containing specifics strings.
jobnameSTRING--jobnameUse an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option.
resolvedBOOLEAN--resolvedShow/write only resolved subdomains.
wordlistFILE--wordlistWordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode.
ipv6-onlyBOOLEAN--ipv6-onlyPerform a IPv6 lookup only
last-portSTRING--lportLast port to scan. Default 1000.
randomizeBOOLEAN--randomizeEnable randomization when reading targets from files.
resolversFILE--resolversPath to a file containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used.
enable-dotBOOLEAN--enable-dotEnable DNS over TLS for resolving subdomains IPs.
no-monitorBOOLEAN--no-monitorDisable monitoring mode while saving data to database.
no-resolveBOOLEAN--no-resolveDisable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots.
rate-limitSTRING--rate-limitSet the rate limit in seconds for each target during enumeration.
subdomainsFILE--fileUse a list of subdomains writen in a file as input.
as-resolverBOOLEAN--as-resolverUse Findomain as resolver for a list of domains in a file.
config-fileFILE--configUse a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml.
http-statusBOOLEAN--http-statusCheck the HTTP status of subdomains.
target-hostSTRING--targetTarget host.
user-agentsFILE--uaPath to file containing user agents strings.
http-timeoutSTRING--http-timeoutValue in seconds for the HTTP Status check of subdomains. Default 5
initial-portSTRING--iportInitial port to scan. Default 0.
no-wildcardsBOOLEAN--no-wildcardsDisable wilcard detection when resolving subdomains.
verbose-modeBOOLEAN--verboseEnable verbose mode (useful to debug problems).
postgres-hostSTRING--postgres-hostPostgresql host.
postgres-portSTRING--postgres-portPostgresql port.
postgres-userSTRING--postgres-userPostgresql username.
query-jobnameSTRING--query-jobnameExtract all the subdomains from the database where the job name is the specified using the jobname option.
chrome-sandboxBOOLEAN--sandboxEnable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option.
monitoring-mdeBOOLEAN--monitoring-flagActivate Findomain monitoring mode
query-databaseBOOLEAN--query-databaseQuery the findomain database to search subdomains that have already been discovered.
exclude-sourcesSTRING--exclude-sourcesExclude sources from searching subdomains in. [possible values: certspotter, crtsh, virustotal, sublist3r, facebook, spyse, bufferover, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer,archiveorg, c99, ctsearch]
show-resolved-ipBOOLEAN--ipShow/write the ip address of resolved subdomains.
import-subdomainsFILE--import-subdomainsImport subdomains from one or multiple files. Subdomains need to be one per line in the file to import.
postgres-databaseSTRING--postgres-databasePostgresql database.
postgres-passwordSTRING--postgres-passwordPostgresql password.
external-subdomainsBOOLEAN--external-subdomainsGet external subdomains with amass and subfinder
exclude-subdomain-stringsSTRING--excludeExclude subdomains containing specifics strings.

example

Run findomain

findomain · command
# findomain: passive enum, resolved names only, with IPsfindomain --target example.com --resolved --ip --quiet
sample output
api.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comcdn.example.comwww.example.com

guidance

Choosing findomain

Use findomain when you want subdomain enumeration plus resolve, HTTP status, or an optional port scan in one node. For passive-only coverage pick subfinder. For deeper passive and active mapping pick amass.

subfinder

Passive subdomain discovery across many sources. Faster and source-focused, without built-in resolve, port scan, or HTTP check.

amass

Deeper passive and active enumeration with richer correlation. Heavier to run than findomain.

assetfinder

Minimal passive subdomain finder. Useful as an extra source to feed findomain via --import-subdomains.

faq

findomain questions

Pass --target example.com. Add --quiet for cleaner output and --resolved to keep only names that resolve. On Trickest, set the target-host input on the node.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run findomain yourself

A target feeds Findomain, which enumerates and resolves its subdomains and passes the live hosts to httpx before they land as a queryable output.

Open findomain in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.