loading
Loading content
loading
Recon
Subdomain recon with passive sources, optional brute force, and alive filtering.
overview
oneforall sits in the subdomain-discovery slot: set --target (or --targets), collect from passive sources, optionally --brute, then write a results folder.
Use it when you want enumeration, DNS resolution, and HTTP checks in one run. --alive keeps only names that answered; --fmt selects csv or json for the next node.
Versus subfinder, you trade a lighter passive-only pass for built-in brute, liveness, and optional --takeover. Versus amass, the path is a tighter enumerate-and-validate loop than deep graph OSINT.
use cases
Run OneForAll against a domain to pull subdomains from passive feeds and a brute-force module in one pass, widening the footprint you start from.
Enable the alive filter so the output holds names that resolved and answered, handing the rest of the workflow a validated list.
Turn on takeover scanning so each discovered name is tested for dangling records that an attacker could claim.
Feed a file of domains for bulk enumeration when scoping an organization with many roots rather than a single host.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| dns | BOOLEAN | --dns | Use DNS resolution (default True) |
| req | BOOLEAN | --req | HTTP request subdomains (default True) |
| port | STRING | --port | The port range request to the subdomains (default port: 80) |
| alive | BOOLEAN | --alive | Only export alive subdomains |
| brute | BOOLEAN | --brute | Use brute module (default True) |
| format | STRING | --fmt | result format (csv/json) |
| target | STRING | --target | Target domain |
Showing key inputs. oneforall exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| dns | BOOLEAN | --dns | Use DNS resolution (default True) |
| req | BOOLEAN | --req | HTTP request subdomains (default True) |
| port | STRING | --port | The port range request to the subdomains (default port: 80) |
| alive | BOOLEAN | --alive | Only export alive subdomains |
| brute | BOOLEAN | --brute | Use brute module (default True) |
| format | STRING | --fmt | result format (csv/json) |
| target | STRING | --target | Target domain |
| targets | FILE | --targets | List of domains |
| takeover | BOOLEAN | --takeover | Scan subdomain takeover (default False) |
example
# oneforall: enumerate subdomains for example.comoneforall --target example.com --brute --alive --fmt jsonwww.example.comapi.example.commail.example.comdev.example.comstaging.example.comcdn.example.comvpn.example.comguidance
Reach for oneforall when you want enumeration, DNS resolution, and HTTP validation in one tool. For a quick passive-only first pass, subfinder is lighter; oneforall adds brute force, liveness checks, and optional takeover scanning.
Fast passive-only finder. oneforall adds brute force, resolution, and liveness in the same run.
Deep OSINT enumeration with graph mapping. oneforall stays closer to enumerate-and-validate without the graph layer.
Another all-in-one recon suite. oneforall can bundle takeover scanning into the enumeration node.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds OneForAll, which enumerates, resolves, and probes subdomains, then writes the live, validated names as a queryable output.
Facts on this page come from the live Trickest tool library.