Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Recon

Build a passive subdomain list before resolve

Passive subdomain gathering from certificate logs, DNS aggregators, and archives.

Agent
Build a passive subdomain mapEnumerate many domains in parallelAdd API-key sources for more coverage

overview

What vita does

vita enumerates subdomains by querying passive sources. Pass a single domain with -d or many domains with --file. It collects names from certificate logs, DNS aggregators, and web archives without sending traffic to the targets themselves.

Enable --all to include providers that need an API key. --subs-only keeps results constrained to the subdomain shape you care about. --concurrency controls how many domains fetch in parallel; --flush prints lines as sources respond (filtered, not fully deduplicated); --timeout and --exclude tune slow or noisy sources.

Run at recon start with -d or --file to build the subdomain set, then resolve with dnsx and probe with httpx before scanners. Enable --all for API-key sources and --subs-only to trim noise. Prefer vita or subfinder for passive coverage; add puredns or shuffledns when you also need DNS brute force.

source github.com/junnlikestea/vita

use cases

Where vita fits

Build a passive subdomain map

Point vita at a domain to collect subdomains from certificate logs, DNS aggregators, and archives without touching the target.

Enumerate many domains in parallel

Pass a domains file and raise --concurrency so vita fetches data for hundreds of targets at once, ideal for wide scopes.

Add API-key sources for more coverage

Turn on --all to include providers that require an API key, widening the result set beyond the free sources.

Stream results as they arrive

Enable --flush to print subdomains to stdout the moment a source returns, when getting output early matters more than full dedup.

reference

vita inputs and flags

9 inputs
NameTypeFlagDescription
target-domainSTRING-dTarget domain
domains-fileFILE--fileList of domains
all-sourcesBOOLEAN--allUse sources which require an Api key
subs-onlyBOOLEAN--subs-onlyFilter the results to only those which have the same subdomain
concurrencySTRING--concurrencyThe number of domains to fetch data for concurrently [default: 200]
timeoutSTRING--timeoutConnection timeouts can be useful if you don't want to wait for sources like wayback archive which quite a while. Default is 10 seconds. [default: 15]
excludeSTRING--excludeExcludes sources from data collection
instant-print-stdoutBOOLEAN--flushPrints results to stdout as they're received. Results will still be filtered, but no deduplication will be done

Showing key inputs. vita exposes 9 inputs in total.

Full flag reference (9 inputs)
NameTypeFlagDescription
excludeSTRING--excludeExcludes sources from data collection
timeoutSTRING--timeoutConnection timeouts can be useful if you don't want to wait for sources like wayback archive which quite a while. Default is 10 seconds. [default: 15]
subs-onlyBOOLEAN--subs-onlyFilter the results to only those which have the same subdomain
all-sourcesBOOLEAN--allUse sources which require an Api key
concurrencySTRING--concurrencyThe number of domains to fetch data for concurrently [default: 200]
domains-fileFILE--fileList of domains
target-domainSTRING-dTarget domain
verbosity-levelSTRING--verbosityDifferent levels of verbosity you can set for debugging, values include: debug, info and warn
instant-print-stdoutBOOLEAN--flushPrints results to stdout as they're received. Results will still be filtered, but no deduplication will be done

example

Run vita

vita · command
# vita: passive subdomain gather for example.com with API sourcesvita -d example.com --all --subs-only --concurrency 200
sample output
api.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comwww.example.comcdn.example.com

guidance

Choosing vita

Use vita at the start of recon to build a subdomain list from passive sources. It discovers names but does not resolve or probe them, so follow with dnsx and httpx. For DNS brute forcing, add puredns or shuffledns.

subfinder

Passive subdomain discovery with a large source set. vita is a peer Rust enumerator with similar role.

amass

Deeper enumeration with active options. vita stays lighter and passive-only.

assetfinder

Minimal passive finder. vita covers more sources and supports higher concurrency via --concurrency.

faq

vita questions

Yes. It gathers subdomains from certificate logs, DNS aggregators, and archives, sending no traffic to the target.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run vita yourself

A domain feeds vita, which gathers subdomains from passive sources and passes them to httpx for live probing before they land as a queryable output.

Open vita in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.