loading
Loading content
loading
Discovery
Scroll SecurityTrails with an embedded query and api-key.
overview
securitytrails-sql sends a scroll query to the SecurityTrails API and pages every match. Inputs are query (must be single-quoted) and api-key. Output is FILE and FOLDER of DNS and domain records.
Reach for it when a flat subdomain list is not enough: reverse IP ownership, registrar slices, or historical record filters need an embedded query. Prefer securitytrails-subdomains for one root domain.
Trickest runs it as a managed Discovery node. Seed recon from the scrolled set, or cross-check active finds against SecurityTrails history before probing. The target resolvers see nothing.
use cases
Run a scroll query for a domain's historical A, MX, and NS records to reconstruct infrastructure changes that current DNS no longer shows.
Query every domain that has pointed at an IP or netblock so you can map co-hosted assets that belong to the same owner.
Feed SecurityTrails records into a workflow as the first stage so probing and scanning run against a curated asset list instead of guesses.
Compare brute-forced or crawled subdomains against SecurityTrails history to catch hosts that resolve intermittently or were recently retired.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| query | STRING | · | Scroll query. MUST BE IN SINGLE QUOTES |
| api-key | STRING | · | Specify Securitytrails API key |
Showing key inputs. securitytrails-sql exposes 2 inputs in total.
example
# securitytrails-sql: scroll query for hosts on a documentation IP, api-key set as input# query: 'ip = "198.51.100.10"'# returns hostname rows such as api.example.com, mail.example.comapi.example.commail.example.comwww.example.comstaging.example.comdev.example.comcdn.example.comvpn.example.comportal.example.comguidance
Use when you need SQL-style precision over SecurityTrails and the full scrolled match set. Prefer securitytrails-subdomains for a simple root-domain pull. Prefer shodan-python for device and banner intel instead of DNS history.
Same source, simpler path. Subdomains for one root domain with no query authoring.
Device and service intel, not DNS history. Complements SecurityTrails records.
Bulk Shodan banner export. Use for service dumps, not DNS lookups.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A scroll query feeds securitytrails-sql, which pulls the matching SecurityTrails DNS records and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.