Recon
Enumerate and validate subdomains in one pass
Subdomain recon with passive sources, optional brute force, and alive filtering.
overview
What oneforall does
oneforall sits in the subdomain-discovery slot: set --target (or --targets), collect from passive sources, optionally --brute, then write a results folder.
Use it when you want enumeration, DNS resolution, and HTTP checks in one run. --alive keeps only names that answered; --fmt selects csv or json for the next node.
Versus subfinder, you trade a lighter passive-only pass for built-in brute, liveness, and optional --takeover. Versus amass, the path is a tighter enumerate-and-validate loop than deep graph OSINT.
use cases
Where oneforall fits
Enumerate a domain from many sources
Run OneForAll against a domain to pull subdomains from passive feeds and a brute-force module in one pass, widening the footprint you start from.
Keep only live subdomains
Enable the alive filter so the output holds names that resolved and answered, handing the rest of the workflow a validated list.
Check for subdomain takeover
Turn on takeover scanning so each discovered name is tested for dangling records that an attacker could claim.
Process a list of domains
Feed a file of domains for bulk enumeration when scoping an organization with many roots rather than a single host.
reference
oneforall inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| dns | BOOLEAN | --dns | Use DNS resolution (default True) |
| req | BOOLEAN | --req | HTTP request subdomains (default True) |
| port | STRING | --port | The port range request to the subdomains (default port: 80) |
| alive | BOOLEAN | --alive | Only export alive subdomains |
| brute | BOOLEAN | --brute | Use brute module (default True) |
| format | STRING | --fmt | result format (csv/json) |
| target | STRING | --target | Target domain |
Showing key inputs. oneforall exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| dns | BOOLEAN | --dns | Use DNS resolution (default True) |
| req | BOOLEAN | --req | HTTP request subdomains (default True) |
| port | STRING | --port | The port range request to the subdomains (default port: 80) |
| alive | BOOLEAN | --alive | Only export alive subdomains |
| brute | BOOLEAN | --brute | Use brute module (default True) |
| format | STRING | --fmt | result format (csv/json) |
| target | STRING | --target | Target domain |
| targets | FILE | --targets | List of domains |
| takeover | BOOLEAN | --takeover | Scan subdomain takeover (default False) |
example
Run oneforall
# oneforall: enumerate subdomains for example.comoneforall --target example.com --brute --alive --fmt jsonwww.example.comapi.example.commail.example.comdev.example.comstaging.example.comcdn.example.comvpn.example.comguidance
Choosing oneforall
Reach for oneforall when you want enumeration, DNS resolution, and HTTP validation in one tool. For a quick passive-only first pass, subfinder is lighter; oneforall adds brute force, liveness checks, and optional takeover scanning.
subfinder
Fast passive-only finder. oneforall adds brute force, resolution, and liveness in the same run.
amass
Deep OSINT enumeration with graph mapping. oneforall stays closer to enumerate-and-validate without the graph layer.
sudomy
Another all-in-one recon suite. oneforall can bundle takeover scanning into the enumeration node.
faq
oneforall questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run oneforall yourself
A domain feeds OneForAll, which enumerates, resolves, and probes subdomains, then writes the live, validated names as a queryable output.
Facts on this page come from the live Trickest tool library.