assetfinder
Discover subdomains and related domains
TLDR
Find subdomains and related assets
$ assetfinder [example.com]
Find only subdomains$ assetfinder --subs-only [example.com]
SYNOPSIS
assetfinder [--subs-only] domain
DESCRIPTION
assetfinder discovers domains and subdomains related to a target organization. It queries various sources including certificate transparency logs, DNS databases, and web archives to find associated assets.The tool is useful for reconnaissance in security assessments and for discovering an organization's external attack surface.
PARAMETERS
--subs-only
Only show subdomainsdomain
Target domain to investigate
CONFIGURATION
Some data sources need API credentials, supplied through environment variables:FB_APP_ID, FB_APP_SECRET
Facebook application credentials for the Facebook certificate transparency source.VT_API_KEY
VirusTotal API key.SPYSE_API_TOKEN
Spyse (findsubdomains) API token.
INSTALL
sudo apt install assetfinder
yay -S assetfinder
nix profile install nixpkgs#assetfinder
CAVEATS
Passive reconnaissance only; generates no traffic to target. Results depend on public data sources. May include old or inactive domains.
HISTORY
assetfinder was created by Tom Hudson (tomnomnom) as a fast, simple subdomain discovery tool for security reconnaissance.
