Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Discovery

Scroll SecurityTrails DNS with SQL-style queries

Scroll SecurityTrails with an embedded query and api-key.

Agent
Pull DNS history for a targetReverse-resolve a shared IPSeed a passive recon pipeline

overview

What securitytrails-sql does

securitytrails-sql sends a scroll query to the SecurityTrails API and pages every match. Inputs are query (must be single-quoted) and api-key. Output is FILE and FOLDER of DNS and domain records.

Reach for it when a flat subdomain list is not enough: reverse IP ownership, registrar slices, or historical record filters need an embedded query. Prefer securitytrails-subdomains for one root domain.

Trickest runs it as a managed Discovery node. Seed recon from the scrolled set, or cross-check active finds against SecurityTrails history before probing. The target resolvers see nothing.

use cases

Where securitytrails-sql fits

Pull DNS history for a target

Run a scroll query for a domain's historical A, MX, and NS records to reconstruct infrastructure changes that current DNS no longer shows.

Reverse-resolve a shared IP

Query every domain that has pointed at an IP or netblock so you can map co-hosted assets that belong to the same owner.

Seed a passive recon pipeline

Feed SecurityTrails records into a workflow as the first stage so probing and scanning run against a curated asset list instead of guesses.

Cross-reference active discovery

Compare brute-forced or crawled subdomains against SecurityTrails history to catch hosts that resolve intermittently or were recently retired.

reference

securitytrails-sql inputs and flags

2 inputs
NameTypeFlagDescription
querySTRING·Scroll query. MUST BE IN SINGLE QUOTES
api-keySTRING·Specify Securitytrails API key

Showing key inputs. securitytrails-sql exposes 2 inputs in total.

example

Run securitytrails-sql

securitytrails-sql · command
# securitytrails-sql: scroll query for hosts on a documentation IP, api-key set as input# query: 'ip = "198.51.100.10"'# returns hostname rows such as api.example.com, mail.example.com
sample output
api.example.commail.example.comwww.example.comstaging.example.comdev.example.comcdn.example.comvpn.example.comportal.example.com

guidance

Choosing securitytrails-sql

Use when you need SQL-style precision over SecurityTrails and the full scrolled match set. Prefer securitytrails-subdomains for a simple root-domain pull. Prefer shodan-python for device and banner intel instead of DNS history.

securitytrails-subdomains

Same source, simpler path. Subdomains for one root domain with no query authoring.

shodan-python

Device and service intel, not DNS history. Complements SecurityTrails records.

shodan-download

Bulk Shodan banner export. Use for service dumps, not DNS lookups.

faq

securitytrails-sql questions

A scroll query wrapped in single quotes. The scroll walks every page of matches so large lookups return the full set rather than a capped sample.

related

More Discovery tools

  1. apkurlgrep

    Extract URLs and endpoints from Android APK files.

  2. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  3. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  4. dirsearch

    Web path scanner.

  5. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  6. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

Run securitytrails-sql yourself

A scroll query feeds securitytrails-sql, which pulls the matching SecurityTrails DNS records and writes them as a queryable output.

Run securitytrails-sql in TrickestBrowse the library

Facts on this page come from the live Trickest tool library.