Recon
Pull subdomains from search engines and SubBrute
OSINT subdomain enumeration across search engines, with optional SubBrute.
overview
What sublist3r does
Sublist3r queries search engines and public OSINT sources for a domain's known subdomains, then merges them into one deduplicated list. Google, Bing, Yahoo, Baidu, and Ask feed the pass, along with Netcraft, VirusTotal, ThreatCrowd, and DNSdumpster. A pure passive run sends no traffic to the target.
Add -b to enable the bundled SubBrute module and resolve a built-in wordlist against the domain. Use -e to restrict engines, -t to set brute-force threads, and -p to spot-check discovered hosts on specific TCP ports.
Trickest provides Sublist3r as a managed Recon node. Feed a domain; take FILE and FOLDER names into httpx. Prefer subfinder when you need wider passive sources and per-provider rate limits.
use cases
Where sublist3r fits
Gather subdomains from search engines
Query Google, Bing, Yahoo, Baidu, and Ask at once with -d to collect the subdomains a target already has indexed across the public web.
Add brute forcing for coverage
Turn on the SubBrute module with -b to resolve a wordlist alongside the passive results and catch names the search engines never surfaced.
Scope a target quickly
Run a fast passive sweep at the start of an engagement to build a working subdomain list before deeper recon.
Spot-check open ports
Pass -p with a port list to scan the discovered subdomains and flag which expose services worth probing next.
reference
sublist3r inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain name to enumerate subdomains of. |
| engines | STRING | -e | Comma-separated list of search engines to use. |
| bruteforce | BOOLEAN | -b | Enable the SubBrute brute-force module. |
| threads | STRING | -t | Number of threads to use for the SubBrute brute-force. |
| ports | STRING | -p | Scan the found subdomains against specific TCP ports. |
| verbose | BOOLEAN | -v | Enable verbose mode and display results in real time. |
Showing key inputs. sublist3r exposes 6 inputs in total.
example
Run sublist3r
# search-engine OSINT sweep plus SubBrute, save resultssublist3r -d example.com -e google,bing,yahoo -b -t 50 -o subdomains.txt[-] Enumerating subdomains now for example.com[-] Searching now in Google..[-] Searching now in Bing..[-] Searching now in Yahoo..[-] Total Unique Subdomains Found: 5www.example.comapi.example.commail.example.comdev.example.comstaging.example.comguidance
Choosing sublist3r
Use Sublist3r for a fast OSINT sweep across search engines, with optional SubBrute on the same node. It finds names, not live hosts, so follow with httpx. For broader passive sources and rate-limit controls, pick subfinder.
subfinder
Modern passive enumerator with many sources and per-provider rate limits. Sublist3r leans on search engines plus optional SubBrute.
amass
Deeper OSINT and DNS mapping. Sublist3r is lighter for a first search-engine pass.
faq
sublist3r questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run sublist3r yourself
A domain feeds Sublist3r, which enumerates subdomains via OSINT and passes them to httpx so only live names land as output.
Facts on this page come from the live Trickest tool library.