Discovery
Scroll SecurityTrails DNS with SQL-style queries
Scroll SecurityTrails with an embedded query and api-key.
overview
What securitytrails-sql does
securitytrails-sql sends a scroll query to the SecurityTrails API and pages every match. Inputs are query (must be single-quoted) and api-key. Output is FILE and FOLDER of DNS and domain records.
Reach for it when a flat subdomain list is not enough: reverse IP ownership, registrar slices, or historical record filters need an embedded query. Prefer securitytrails-subdomains for one root domain.
Trickest runs it as a managed Discovery node. Seed recon from the scrolled set, or cross-check active finds against SecurityTrails history before probing. The target resolvers see nothing.
use cases
Where securitytrails-sql fits
Pull DNS history for a target
Run a scroll query for a domain's historical A, MX, and NS records to reconstruct infrastructure changes that current DNS no longer shows.
Reverse-resolve a shared IP
Query every domain that has pointed at an IP or netblock so you can map co-hosted assets that belong to the same owner.
Seed a passive recon pipeline
Feed SecurityTrails records into a workflow as the first stage so probing and scanning run against a curated asset list instead of guesses.
Cross-reference active discovery
Compare brute-forced or crawled subdomains against SecurityTrails history to catch hosts that resolve intermittently or were recently retired.
reference
securitytrails-sql inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| query | STRING | · | Scroll query. MUST BE IN SINGLE QUOTES |
| api-key | STRING | · | Specify Securitytrails API key |
Showing key inputs. securitytrails-sql exposes 2 inputs in total.
example
Run securitytrails-sql
# securitytrails-sql: scroll query for hosts on a documentation IP, api-key set as input
# query: 'ip = "198.51.100.10"'
# returns hostname rows such as api.example.com, mail.example.comapi.example.com
mail.example.com
www.example.com
staging.example.com
dev.example.com
cdn.example.com
vpn.example.com
portal.example.comguidance
Choosing securitytrails-sql
Use when you need SQL-style precision over SecurityTrails and the full scrolled match set. Prefer securitytrails-subdomains for a simple root-domain pull. Prefer shodan-python for device and banner intel instead of DNS history.
securitytrails-subdomains
Same source, simpler path. Subdomains for one root domain with no query authoring.
shodan-python
Device and service intel, not DNS history. Complements SecurityTrails records.
shodan-download
Bulk Shodan banner export. Use for service dumps, not DNS lookups.
faq
securitytrails-sql questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run securitytrails-sql yourself
A scroll query feeds securitytrails-sql, which pulls the matching SecurityTrails DNS records and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.