findomain
Fast passive subdomain finder (CT, APIs, cross-spot). Extra source to pipe into dnsx/httpx alongside subfinder.
Tags: subdomains, passive, ct
- Category
- recon
- Maintenance signal
- active
Use this when: Intake. Use this on a root you are allowed to resolve. The output is a host list, not a finding.
Install
cargo
cargo install findomainbin
# grab the latest release from github.com/findomain/findomain/releasesCommand templates
Passive
findomain -t {domain} -q | anew subs.txt