Does xsubfind3r brute-force subdomains?

No. xsubfind3r is passive only; it reads names from public sources rather than guessing them against a wordlist. For active brute forcing, pair it with a resolver-based tool that mutates a wordlist against DNS, then merge both result sets for wider coverage.

Can I choose which sources it queries?

Yes. Pass --sources-to-use to limit discovery to a comma-separated set of providers, or --sources-to-exclude to drop ones you do not want. Trimming the source list trades some coverage for a faster run and lets you skip providers whose keys you do not hold.

Do I need API keys to run it?

Several sources work anonymously, but providers like Shodan, VirusTotal, and Censys return more subdomains when authenticated. Put those keys in a --configuration file so xsubfind3r reads them at runtime; unauthenticated sources are still queried where they allow it.

How do I get pipeline-ready output?

Run with --silent so it prints only subdomains, one per line, with no banner or color. Redirect that to a file or wire the node's output into the next step so a resolver and prober consume the list without extra parsing.

What should I run after xsubfind3r?

Resolve the names against DNS to drop dead entries, then probe the survivors with httpx to record which hosts respond, their status codes, titles, and tech. That turns a passive name list into a set of live, classified targets for the rest of the workflow.

xsubfind3r or subfinder, which should I use?

Both do passive subdomain discovery from overlapping source sets, so results are close. Pick by which providers each one supports and which API keys you already have; running both and merging the output usually finds more names than either alone.

Updated Jul 14, 2026

Recon

Discover a domain's subdomains from passive OSINT sources

Efficiently identify known subdomains from curated passive sources.

Map a domain's subdomains passively Enumerate a whole scope at once Pick sources to balance speed and depth

overview

What xsubfind3r does

xsubfind3r finds a domain's known subdomains by querying a curated set of passive OSINT sources: certificate transparency logs, search and threat-intel datasets, and web archives. It aggregates what those providers already record, so the requests reach the data sources instead of the target and the domain sees no scan traffic.

The tool is built for pipeline use. Scan one domain with --domain or a whole scope from a --list file, narrow coverage with --sources-to-use and --sources-to-exclude, and run --silent to emit nothing but subdomains, one per line. A --configuration file holds source settings and the API keys that providers like Shodan or VirusTotal need.

On Trickest, xsubfind3r is a Recon node that takes a domain or list and writes a file and a folder of results. Reach for it at the front of an attack-surface workflow, then resolve and probe the names downstream to turn a passive list into live, classified hosts.

source github.com/hueristiq/xsubfind3r

use cases

Where xsubfind3r fits

Map a domain's subdomains passively

Aggregate known subdomains from passive sources so you build an attack-surface picture without sending a single request to the target.

Enumerate a whole scope at once

Pass a --list file of domains so every asset in scope gets passive subdomain discovery in one node, with results deduplicated across the inputs.

Pick sources to balance speed and depth

Select providers with --sources-to-use or drop them with --sources-to-exclude to trade coverage against speed and skip sources whose keys you do not hold.

Pipe clean output into resolution

Run --silent to emit only subdomains, one per line, so a resolver and prober downstream consume the list without parsing a banner or color codes.

reference

xsubfind3r inputs and flags

8 inputs

Name	Type	Flag	Description
domain	STRING	--domain	Target domain to enumerate.
list	FILE	--list	File of target domains for bulk discovery.
sources-to-use	STRING	--sources-to-use	Comma-separated sources to include.
sources-to-exclude	STRING	--sources-to-exclude	Comma-separated sources to skip.
configuration	FILE	--configuration	Configuration file with source settings and API keys.
silent	BOOLEAN	--silent	Print only subdomains, one per line.

Showing key inputs. xsubfind3r exposes 8 inputs in total.

Full flag reference (8 inputs)

Name	Type	Flag	Description
domain	STRING	--domain	target domain
list	FILE	--list	target domains list file path
sources-to-use	STRING	--sources-to-use	comma separated sources to use
sources-to-exclude	STRING	--sources-to-exclude	comma separated sources to exclude
configuration	FILE	--configuration	configuration file holding source settings and API keys
silent	BOOLEAN	--silent	display output subdomains only
verbose	BOOLEAN	--verbose	display verbose output
monochrome	BOOLEAN	--monochrome	display no-color output

example

Run xsubfind3r

xsubfind3r · command

# passive subdomain discovery from a chosen set of sources, quiet outputxsubfind3r --domain example.com --sources-to-use crtsh,wayback --silent > subdomains.txt

sample output

api.example.comwww.example.commail.example.comdev.example.comstaging.example.comvpn.example.comblog.example.comcdn.example.comadmin.example.com…  (37 subdomains aggregated from crtsh, wayback, and otx)

guidance

Choosing xsubfind3r

Use xsubfind3r when you want quiet, passive subdomain discovery from curated sources. To brute-force subdomains actively, pair it with a resolver-based tool; to crawl an app's endpoints, use katana.

subfinder

Widely used passive subdomain finder. Similar approach; choose by source coverage and the keys you hold.

amass

Heavier surface mapper with passive and active modes. More thorough, slower than a passive-only run.

faq

xsubfind3r questions

It queries curated passive OSINT sources, including certificate transparency logs, threat-intel datasets, and web archives, then aggregates the subdomains they already record. Every request goes to those providers, so the target domain receives no scan traffic and never sees you enumerate it.

Run xsubfind3r yourself

A domain feeds xsubfind3r, which gathers known subdomains from passive sources and passes them to httpx for probing before they land as classified live hosts.

Run xsubfind3r in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

domain

STRING

--domain

Target domain to enumerate.

list

FILE

--list

File of target domains for bulk discovery.

sources-to-use

STRING

--sources-to-use

Comma-separated sources to include.

sources-to-exclude

STRING

--sources-to-exclude

Comma-separated sources to skip.

configuration

FILE

--configuration

Configuration file with source settings and API keys.

silent

BOOLEAN

--silent

Print only subdomains, one per line.

Name

Type

Flag

Description

domain

STRING

--domain

target domain

list

FILE

--list

target domains list file path

sources-to-use

STRING

--sources-to-use

comma separated sources to use

sources-to-exclude

STRING

--sources-to-exclude

comma separated sources to exclude

configuration

FILE

--configuration

configuration file holding source settings and API keys

silent

BOOLEAN

--silent

display output subdomains only

verbose

BOOLEAN

--verbose

display verbose output

monochrome

BOOLEAN

--monochrome

display no-color output

api.example.comwww.example.commail.example.comdev.example.comstaging.example.comvpn.example.comblog.example.comcdn.example.comadmin.example.com… (37 subdomains aggregated from crtsh, wayback, and otx)

Discover a domain's subdomains from passive OSINT sources

What xsubfind3r does

Where xsubfind3r fits

Map a domain's subdomains passively

Enumerate a whole scope at once

Pick sources to balance speed and depth

Pipe clean output into resolution

xsubfind3r inputs and flags

Run xsubfind3r

Choosing xsubfind3r

subfinder

amass

xsubfind3r questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run xsubfind3r yourself

Discover a domain's subdomains from passive OSINT sources

What xsubfind3r does

Where xsubfind3r fits

Map a domain's subdomains passively

Enumerate a whole scope at once

Pick sources to balance speed and depth

Pipe clean output into resolution

xsubfind3r inputs and flags

Run xsubfind3r

Choosing xsubfind3r

subfinder

amass

xsubfind3r questions

More Recon tools

aiodnsbrute

amass

amass-intel

amass-json

analyticsrelationships

assetfinder

Run xsubfind3r yourself