loading
Loading content
loading
Recon
Passive SecurityTrails subdomain list for one root domain.
overview
securitytrails-subdomains asks SecurityTrails for hostnames under a root-domain and parses them into a flat list. Inputs are root-domain and api-key. Output is FILE and FOLDER.
The lookup is passive: no traffic to target resolvers. Use it as an early recon seed, or merge with active brute-force so dormant and live names both appear before probing.
Trickest runs it as a managed Recon node. Pair with shuffledns for resolution, or switch to securitytrails-sql when you need arbitrary scroll filters beyond one root.
use cases
Pull SecurityTrails subdomains for a root domain to grow the target list without sending a request to the target's infrastructure.
Surface subdomains from passive DNS history that no longer appear in live resolution but may still answer or leak information.
Feed the SecurityTrails set into a brute-force tool so its wordlist run starts from known-good hosts and finds more siblings.
Merge this output with crawler and certificate-transparency results so the final host list draws on several independent sources.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| root-domain | STRING | · | Root domain to find and parse subdomains from response |
| api-key | STRING | · | SecurityTrails API key |
Showing key inputs. securitytrails-subdomains exposes 2 inputs in total.
example
# securitytrails-subdomains: passive pull for example.com (api-key as node input)# root-domain: example.com# writes one subdomain per line for downstream resolverswww.example.comapi.example.commail.example.comstaging.example.comdev.example.comcdn.example.comvpn.example.comportal.example.comstatus.example.comguidance
Use when you want a quiet SecurityTrails subdomain list for one root-domain with no target traffic. Prefer securitytrails-sql for arbitrary scroll queries. Pair with shuffledns when you need active brute-force resolution.
Same source with full query control. Use when a flat subdomain list is not enough.
Active brute-force and resolution. Feed it the passive set as known seeds.
Service and device intel, not DNS inventory. A different lens on the same target.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A root domain feeds securitytrails-subdomains, whose passive set seeds shuffledns to resolve and confirm the final subdomain list.
Facts on this page come from the live Trickest tool library.