Does xsubfind3r brute-force subdomains?

No. It is passive only; it reads names from public sources rather than guessing against a wordlist. For active brute forcing, pair it with a resolver-based tool and merge both result sets.

Can I choose which sources it queries?

Yes. Pass --sources-to-use to limit discovery to a comma-separated set, or --sources-to-exclude to drop providers. Trimming sources trades coverage for a faster run and skips keys you do not hold.

Do I need API keys to run it?

Several sources work anonymously, but providers like Shodan, VirusTotal, and Censys return more when authenticated. Put those keys in a --configuration file; unauthenticated sources are still queried where allowed.

How do I get pipeline-ready output?

Run with --silent so it prints only subdomains, one per line, with no banner or color. Wire that into a resolver and prober without extra parsing.

xsubfind3r or subfinder, which should I use?

Both do passive subdomain discovery from overlapping source sets. Pick by which providers each supports and which API keys you already have; merging both outputs often finds more names than either alone.

Updated Jul 14, 2026

Recon

Collect known subdomains without touching the target

Passive subdomain discovery from curated OSINT sources.

Map a domain's subdomains passively Enumerate a whole scope at once Pick sources to balance speed and depth

overview

What xsubfind3r does

xsubfind3r finds a domain's known subdomains by querying curated passive OSINT sources: certificate transparency logs, search and threat-intel datasets, and web archives. Requests hit those providers, not the target.

Scan one host with --domain or a whole scope from --list. Narrow coverage with --sources-to-use and --sources-to-exclude. Run --silent for one subdomain per line. Put API keys in --configuration when providers such as Shodan or VirusTotal need them.

Slot it at the front of an attack-surface workflow, then resolve and probe names downstream. Overlaps with subfinder on passive discovery; pick by source coverage and the keys you hold. Trickest runs it as a managed Recon node.

source github.com/hueristiq/xsubfind3r

use cases

Where xsubfind3r fits

Map a domain's subdomains passively

Aggregate known subdomains from passive sources so you build an attack-surface picture without sending a single request to the target.

Enumerate a whole scope at once

Pass a --list file of domains so every asset in scope gets passive subdomain discovery in one node, with results deduplicated across the inputs.

Pick sources to balance speed and depth

Select providers with --sources-to-use or drop them with --sources-to-exclude to trade coverage against speed and skip sources whose keys you do not hold.

Pipe clean output into resolution

Run --silent to emit only subdomains, one per line, so a resolver and prober downstream consume the list without parsing a banner or color codes.

reference

xsubfind3r inputs and flags

8 inputs

Name	Type	Flag	Description
domain	STRING	--domain	Target domain to enumerate.
list	FILE	--list	File of target domains for bulk discovery.
sources-to-use	STRING	--sources-to-use	Comma-separated sources to include.
sources-to-exclude	STRING	--sources-to-exclude	Comma-separated sources to skip.
configuration	FILE	--configuration	Configuration file with source settings and API keys.
silent	BOOLEAN	--silent	Print only subdomains, one per line.

Showing key inputs. xsubfind3r exposes 8 inputs in total.

Full flag reference (8 inputs)

Name	Type	Flag	Description
domain	STRING	--domain	target domain
list	FILE	--list	target domains list file path
sources-to-use	STRING	--sources-to-use	comma separated sources to use
sources-to-exclude	STRING	--sources-to-exclude	comma separated sources to exclude
configuration	FILE	--configuration	configuration file holding source settings and API keys
silent	BOOLEAN	--silent	display output subdomains only
verbose	BOOLEAN	--verbose	display verbose output
monochrome	BOOLEAN	--monochrome	display no-color output

example

Run xsubfind3r

xsubfind3r · command

# passive subdomain discovery from a chosen set of sources, quiet outputxsubfind3r --domain example.com --sources-to-use crtsh,wayback --silent > subdomains.txt

sample output

api.example.comwww.example.commail.example.comdev.example.comstaging.example.comvpn.example.comblog.example.comcdn.example.comadmin.example.com…  (37 subdomains aggregated from crtsh, wayback, and otx)

guidance

Choosing xsubfind3r

Use xsubfind3r when you want quiet passive subdomain discovery from curated sources. For active brute force, pair it with a resolver-based tool; for app endpoint crawl, use katana.

subfinder

Widely used passive subdomain finder. Similar approach; choose by source coverage and the keys you hold.

amass

Heavier surface mapper with passive and active modes. More thorough, slower than a passive-only run.

faq

xsubfind3r questions

It queries curated passive OSINT sources, including certificate transparency logs, threat-intel datasets, and web archives, then aggregates names they already record. Every request goes to those providers.

Run xsubfind3r yourself

A domain feeds xsubfind3r, which gathers known subdomains from passive sources and passes them to httpx for probing before they land as classified live hosts.

Open xsubfind3r in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Collect known subdomains without touching the target

What xsubfind3r does

Where xsubfind3r fits

Map a domain's subdomains passively

Enumerate a whole scope at once

Pick sources to balance speed and depth

Pipe clean output into resolution

xsubfind3r inputs and flags

Run xsubfind3r

Choosing xsubfind3r

subfinder

amass

xsubfind3r questions

More Recon tools

amass

amass-intel

assetfinder

bbot

bevigil

cloud-enum

Run xsubfind3r yourself