loading
Loading content
loading
Recon
Gather subdomains from passive sources.
overview
vita enumerates subdomains by querying passive sources rather than brute forcing DNS. Give it a domain and it collects names from certificate logs, DNS aggregators, and web archives, returning a broad picture of an organization's footprint without sending traffic to the targets themselves. It is written in Rust, so it stays fast even when fanning out across many domains at once.
It is built for breadth and throughput. High concurrency lets it fetch data for hundreds of domains in parallel, --all pulls in providers that require an API key, and --subs-only filtering keeps results constrained to the subdomain you care about. --flush streams results to stdout as they arrive when you want output sooner rather than fully deduplicated.
In a Trickest workflow, vita takes a target domain or a file of domains and writes a file and a folder of subdomains. Run it at the start of a recon pipeline to build the subdomain set, then resolve and probe the results before handing live hosts to scanners downstream.
source github.com/junnlikestea/vita
use cases
Point vita at a domain to collect subdomains from certificate logs, DNS aggregators, and archives without touching the target.
Pass a domains file and raise --concurrency so vita fetches data for hundreds of targets at once, ideal for wide scopes.
Turn on --all to include providers that require an API key, widening the result set beyond the free sources.
Enable --flush to print subdomains to stdout the moment a source returns, when getting output early matters more than full dedup.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-domain | STRING | -d | Target domain |
| domains-file | FILE | --file | List of domains |
| all-sources | BOOLEAN | --all | Use sources which require an Api key |
| subs-only | BOOLEAN | --subs-only | Filter the results to only those which have the same subdomain |
| concurrency | STRING | --concurrency | The number of domains to fetch data for concurrently [default: 200] |
| timeout | STRING | --timeout | Connection timeouts can be useful if you don't want to wait for sources like wayback archive which quite a while. Default is 10 seconds. [default: 15] |
| exclude | STRING | --exclude | Excludes sources from data collection |
| instant-print-stdout | BOOLEAN | --flush | Prints results to stdout as they're received. Results will still be filtered, but no deduplication will be done |
Showing key inputs. vita exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| exclude | STRING | --exclude | Excludes sources from data collection |
| timeout | STRING | --timeout | Connection timeouts can be useful if you don't want to wait for sources like wayback archive which quite a while. Default is 10 seconds. [default: 15] |
| subs-only | BOOLEAN | --subs-only | Filter the results to only those which have the same subdomain |
| all-sources | BOOLEAN | --all | Use sources which require an Api key |
| concurrency | STRING | --concurrency | The number of domains to fetch data for concurrently [default: 200] |
| domains-file | FILE | --file | List of domains |
| target-domain | STRING | -d | Target domain |
| verbosity-level | STRING | --verbosity | Different levels of verbosity you can set for debugging, values include: debug, info and warn |
| instant-print-stdout | BOOLEAN | --flush | Prints results to stdout as they're received. Results will still be filtered, but no deduplication will be done |
example
# vita: passive subdomain gather for example.com with API sourcesvita -d example.com --all --subs-only --concurrency 200api.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comwww.example.comcdn.example.comguidance
Use vita at the start of recon to build a subdomain list from passive sources, fast and quietly. It discovers names but does not resolve or probe them, so follow it with a resolver like dnsx and a prober like httpx. For DNS brute forcing on top, add puredns or shuffledns.
Passive subdomain discovery with a large source set. vita is a fast Rust alternative.
Deeper, slower enumeration with active options. vita is lighter and passive-only.
Minimal passive finder. vita pulls from more sources and runs at higher concurrency.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
A domain feeds vita, which gathers subdomains from passive sources and passes them to httpx for live probing before they land as a queryable output.
Facts on this page come from the live Trickest tool library.