loading
Loading content
loading
Recon
OSINT subdomain enumeration across search engines, with optional SubBrute.
overview
Sublist3r queries search engines and public OSINT sources for a domain's known subdomains, then merges them into one deduplicated list. Google, Bing, Yahoo, Baidu, and Ask feed the pass, along with Netcraft, VirusTotal, ThreatCrowd, and DNSdumpster. A pure passive run sends no traffic to the target.
Add -b to enable the bundled SubBrute module and resolve a built-in wordlist against the domain. Use -e to restrict engines, -t to set brute-force threads, and -p to spot-check discovered hosts on specific TCP ports.
Trickest provides Sublist3r as a managed Recon node. Feed a domain; take FILE and FOLDER names into httpx. Prefer subfinder when you need wider passive sources and per-provider rate limits.
use cases
Query Google, Bing, Yahoo, Baidu, and Ask at once with -d to collect the subdomains a target already has indexed across the public web.
Turn on the SubBrute module with -b to resolve a wordlist alongside the passive results and catch names the search engines never surfaced.
Run a fast passive sweep at the start of an engagement to build a working subdomain list before deeper recon.
Pass -p with a port list to scan the discovered subdomains and flag which expose services worth probing next.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain name to enumerate subdomains of. |
| engines | STRING | -e | Comma-separated list of search engines to use. |
| bruteforce | BOOLEAN | -b | Enable the SubBrute brute-force module. |
| threads | STRING | -t | Number of threads to use for the SubBrute brute-force. |
| ports | STRING | -p | Scan the found subdomains against specific TCP ports. |
| verbose | BOOLEAN | -v | Enable verbose mode and display results in real time. |
Showing key inputs. sublist3r exposes 6 inputs in total.
example
# search-engine OSINT sweep plus SubBrute, save resultssublist3r -d example.com -e google,bing,yahoo -b -t 50 -o subdomains.txt[-] Enumerating subdomains now for example.com[-] Searching now in Google..[-] Searching now in Bing..[-] Searching now in Yahoo..[-] Total Unique Subdomains Found: 5www.example.comapi.example.commail.example.comdev.example.comstaging.example.comguidance
Use Sublist3r for a fast OSINT sweep across search engines, with optional SubBrute on the same node. It finds names, not live hosts, so follow with httpx. For broader passive sources and rate-limit controls, pick subfinder.
Modern passive enumerator with many sources and per-provider rate limits. Sublist3r leans on search engines plus optional SubBrute.
Deeper OSINT and DNS mapping. Sublist3r is lighter for a first search-engine pass.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds Sublist3r, which enumerates subdomains via OSINT and passes them to httpx so only live names land as output.
Facts on this page come from the live Trickest tool library.