Recon
Pull passive SecurityTrails intel from domains
CLI client for SecurityTrails subdomain, WHOIS, and DNS modes.
overview
What haktrails does
haktrails is a Go client for the SecurityTrails API. Feed a domains FILE plus an api-key, pick a mode (subdomains, whois, historicaldns, associateddomains, associatedips, tags), and get passive results without probing the target.
Use it when you hold a SecurityTrails key and want vendor intel early. -t sets threads, but the API plan caps throughput. For historicaldns, set -type to a, aaaa, mx, ns, soa, or txt.
Trickest exposes haktrails as a managed Recon node that writes FILE and FOLDER. Seed httpx from subdomains mode. Prefer subfinder when you need many passive sources without a single-vendor key.
source github.com/hakluke/haktrails
use cases
Where haktrails fits
Enumerate subdomains passively
Run subdomains mode against a domains list to pull SecurityTrails' known subdomains without sending a single request to the target.
Pull historical DNS and WHOIS
Use historicaldns and historicalwhois modes to recover past records and registration data that reveal infrastructure changes and ownership over time. Set -type to pick the DNS record type.
Expand scope from one domain
Use associateddomains and associatedips modes to find related assets, broadening an engagement's scope from a single seed domain.
Seed a probing pipeline
Feed haktrails subdomains straight into httpx so the rest of the workflow runs against the full discovered surface.
reference
haktrails inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | List of target domains to query, one per line. |
| api-key | STRING | · | SecurityTrails API key used to authenticate every request. |
| subdomains | BOOLEAN | subdomains | Subdomains mode: pull known subdomains for each domain. |
| associateddomains | BOOLEAN | associateddomains | Associated domains mode: find domains related to each target to widen scope. |
| associatedips | BOOLEAN | associatedips | Associated IPs mode: return IP addresses linked to each domain. |
| historicaldns | BOOLEAN | historicaldns | Historical DNS mode: return past DNS records (set -type for the record type). |
| whois | BOOLEAN | whois | WHOIS mode: return current registration data. |
| type | STRING | -type | DNS record type for historical DNS queries: a, aaaa, mx, ns, soa, txt (default a). |
Showing key inputs. haktrails exposes 14 inputs in total.
Full flag reference (14 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| tags | BOOLEAN | tags | Tags mode: return SecurityTrails tags for each domain. |
| type | STRING | -type | DNS record type for historical DNS queries: a, aaaa, mx, ns, soa, txt (default a). |
| whois | BOOLEAN | whois | Whois mode: return current WHOIS registration data. |
| api-key | STRING | · | SecurityTrails API key used to authenticate every request. |
| company | BOOLEAN | company | Company mode: return company details for each domain. |
| details | BOOLEAN | details | Details mode: return SecurityTrails record details for each domain. |
| domains | FILE | · | Target domains to query, one per line. |
| threads | STRING | -t | Number of threads to use; the API enforces its own rate limits (default 2). |
| subdomains | BOOLEAN | subdomains | Subdomains mode: return known subdomains for each domain. |
| associatedips | BOOLEAN | associatedips | Associated IPs mode: return IP addresses linked to each domain. |
| historicaldns | BOOLEAN | historicaldns | Historical DNS mode: return past DNS records for each domain. |
| subs-per-host | STRING | -b | Number of subdomains to send per request for the submission endpoint (default 100). |
| historicalwhois | BOOLEAN | historicalwhois | Historical WHOIS mode: return past WHOIS registration data for each domain. |
| associateddomains | BOOLEAN | associateddomains | Associated domains mode: return domains related to each target. |
example
Run haktrails
# pull SecurityTrails subdomains for a domainecho example.com | haktrails subdomainsapi.example.comwww.example.commail.example.comdev.example.comstaging.example.comvpn.example.comblog.example.comcdn.example.com… (one subdomain per line, ready to pipe into httpx)guidance
Choosing haktrails
Use when you have a SecurityTrails key and want passive subdomain, DNS, or WHOIS data without touching the target. Prefer subfinder for multi-source passive coverage. Follow with httpx for live checks.
subfinder
Aggregates passive subdomains from many sources. Broader coverage without a single-vendor key.
amass
Deeper OSINT and active enumeration. Wider asset graph than a single API client.
assetfinder
Lightweight passive subdomain finder. Fewer modes than haktrails.
faq
haktrails questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run haktrails yourself
A domains list feeds haktrails, which queries SecurityTrails for subdomains and passes them to httpx for live probing before they land as a queryable output.
Facts on this page come from the live Trickest tool library.