loading
Loading content
loading
Recon
CLI client for SecurityTrails subdomain, WHOIS, and DNS modes.
overview
haktrails is a Go client for the SecurityTrails API. Feed a domains FILE plus an api-key, pick a mode (subdomains, whois, historicaldns, associateddomains, associatedips, tags), and get passive results without probing the target.
Use it when you hold a SecurityTrails key and want vendor intel early. -t sets threads, but the API plan caps throughput. For historicaldns, set -type to a, aaaa, mx, ns, soa, or txt.
Trickest exposes haktrails as a managed Recon node that writes FILE and FOLDER. Seed httpx from subdomains mode. Prefer subfinder when you need many passive sources without a single-vendor key.
source github.com/hakluke/haktrails
use cases
Run subdomains mode against a domains list to pull SecurityTrails' known subdomains without sending a single request to the target.
Use historicaldns and historicalwhois modes to recover past records and registration data that reveal infrastructure changes and ownership over time. Set -type to pick the DNS record type.
Use associateddomains and associatedips modes to find related assets, broadening an engagement's scope from a single seed domain.
Feed haktrails subdomains straight into httpx so the rest of the workflow runs against the full discovered surface.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domains | FILE | · | List of target domains to query, one per line. |
| api-key | STRING | · | SecurityTrails API key used to authenticate every request. |
| subdomains | BOOLEAN | subdomains | Subdomains mode: pull known subdomains for each domain. |
| associateddomains | BOOLEAN | associateddomains | Associated domains mode: find domains related to each target to widen scope. |
| associatedips | BOOLEAN | associatedips | Associated IPs mode: return IP addresses linked to each domain. |
| historicaldns | BOOLEAN | historicaldns | Historical DNS mode: return past DNS records (set -type for the record type). |
| whois | BOOLEAN | whois | WHOIS mode: return current registration data. |
| type | STRING | -type | DNS record type for historical DNS queries: a, aaaa, mx, ns, soa, txt (default a). |
Showing key inputs. haktrails exposes 14 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| tags | BOOLEAN | tags | Tags mode: return SecurityTrails tags for each domain. |
| type | STRING | -type | DNS record type for historical DNS queries: a, aaaa, mx, ns, soa, txt (default a). |
| whois | BOOLEAN | whois | Whois mode: return current WHOIS registration data. |
| api-key | STRING | · | SecurityTrails API key used to authenticate every request. |
| company | BOOLEAN | company | Company mode: return company details for each domain. |
| details | BOOLEAN | details | Details mode: return SecurityTrails record details for each domain. |
| domains | FILE | · | Target domains to query, one per line. |
| threads | STRING | -t | Number of threads to use; the API enforces its own rate limits (default 2). |
| subdomains | BOOLEAN | subdomains | Subdomains mode: return known subdomains for each domain. |
| associatedips | BOOLEAN | associatedips | Associated IPs mode: return IP addresses linked to each domain. |
| historicaldns | BOOLEAN | historicaldns | Historical DNS mode: return past DNS records for each domain. |
| subs-per-host | STRING | -b | Number of subdomains to send per request for the submission endpoint (default 100). |
| historicalwhois | BOOLEAN | historicalwhois | Historical WHOIS mode: return past WHOIS registration data for each domain. |
| associateddomains | BOOLEAN | associateddomains | Associated domains mode: return domains related to each target. |
example
# pull SecurityTrails subdomains for a domainecho example.com | haktrails subdomainsapi.example.comwww.example.commail.example.comdev.example.comstaging.example.comvpn.example.comblog.example.comcdn.example.com… (one subdomain per line, ready to pipe into httpx)guidance
Use when you have a SecurityTrails key and want passive subdomain, DNS, or WHOIS data without touching the target. Prefer subfinder for multi-source passive coverage. Follow with httpx for live checks.
Aggregates passive subdomains from many sources. Broader coverage without a single-vendor key.
Deeper OSINT and active enumeration. Wider asset graph than a single API client.
Lightweight passive subdomain finder. Fewer modes than haktrails.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domains list feeds haktrails, which queries SecurityTrails for subdomains and passes them to httpx for live probing before they land as a queryable output.
Facts on this page come from the live Trickest tool library.