loading
Loading content
loading
Recon
Passive subdomain gathering from certificate logs, DNS aggregators, and archives.
overview
vita enumerates subdomains by querying passive sources. Pass a single domain with -d or many domains with --file. It collects names from certificate logs, DNS aggregators, and web archives without sending traffic to the targets themselves.
Enable --all to include providers that need an API key. --subs-only keeps results constrained to the subdomain shape you care about. --concurrency controls how many domains fetch in parallel; --flush prints lines as sources respond (filtered, not fully deduplicated); --timeout and --exclude tune slow or noisy sources.
Run at recon start with -d or --file to build the subdomain set, then resolve with dnsx and probe with httpx before scanners. Enable --all for API-key sources and --subs-only to trim noise. Prefer vita or subfinder for passive coverage; add puredns or shuffledns when you also need DNS brute force.
source github.com/junnlikestea/vita
use cases
Point vita at a domain to collect subdomains from certificate logs, DNS aggregators, and archives without touching the target.
Pass a domains file and raise --concurrency so vita fetches data for hundreds of targets at once, ideal for wide scopes.
Turn on --all to include providers that require an API key, widening the result set beyond the free sources.
Enable --flush to print subdomains to stdout the moment a source returns, when getting output early matters more than full dedup.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-domain | STRING | -d | Target domain |
| domains-file | FILE | --file | List of domains |
| all-sources | BOOLEAN | --all | Use sources which require an Api key |
| subs-only | BOOLEAN | --subs-only | Filter the results to only those which have the same subdomain |
| concurrency | STRING | --concurrency | The number of domains to fetch data for concurrently [default: 200] |
| timeout | STRING | --timeout | Connection timeouts can be useful if you don't want to wait for sources like wayback archive which quite a while. Default is 10 seconds. [default: 15] |
| exclude | STRING | --exclude | Excludes sources from data collection |
| instant-print-stdout | BOOLEAN | --flush | Prints results to stdout as they're received. Results will still be filtered, but no deduplication will be done |
Showing key inputs. vita exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| exclude | STRING | --exclude | Excludes sources from data collection |
| timeout | STRING | --timeout | Connection timeouts can be useful if you don't want to wait for sources like wayback archive which quite a while. Default is 10 seconds. [default: 15] |
| subs-only | BOOLEAN | --subs-only | Filter the results to only those which have the same subdomain |
| all-sources | BOOLEAN | --all | Use sources which require an Api key |
| concurrency | STRING | --concurrency | The number of domains to fetch data for concurrently [default: 200] |
| domains-file | FILE | --file | List of domains |
| target-domain | STRING | -d | Target domain |
| verbosity-level | STRING | --verbosity | Different levels of verbosity you can set for debugging, values include: debug, info and warn |
| instant-print-stdout | BOOLEAN | --flush | Prints results to stdout as they're received. Results will still be filtered, but no deduplication will be done |
example
# vita: passive subdomain gather for example.com with API sourcesvita -d example.com --all --subs-only --concurrency 200api.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comwww.example.comcdn.example.comguidance
Use vita at the start of recon to build a subdomain list from passive sources. It discovers names but does not resolve or probe them, so follow with dnsx and httpx. For DNS brute forcing, add puredns or shuffledns.
Passive subdomain discovery with a large source set. vita is a peer Rust enumerator with similar role.
Deeper enumeration with active options. vita stays lighter and passive-only.
Minimal passive finder. vita covers more sources and supports higher concurrency via --concurrency.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds vita, which gathers subdomains from passive sources and passes them to httpx for live probing before they land as a queryable output.
Facts on this page come from the live Trickest tool library.