findomain

Find subdomains for a domain

$ findomain -t [example.com]

$ findomain -t [example.com] -o

$ findomain -t [example.com] -a

$ findomain -t [example.com] --resolved

$ findomain -t [example.com] --json

$ findomain -f [domains.txt]

findomain [options] -t domain

findomain is a cross-platform subdomain enumerator. It queries multiple data sources to discover subdomains for a target domain, useful for reconnaissance in security assessments.
The tool aggregates results from certificate transparency logs, search engines, and other passive sources without making direct requests to the target.

-t domain

Target domain.

Read domains from file.

Output to file.

Use all available APIs.

Show only resolving subdomains.

Show IP addresses.

Output in JSON format.

Suppress informational output.

Remove duplicates.

~/.config/findomain/config.toml

API keys for data sources like SecurityTrails, Shodan, and VirusTotal.

API keys needed for some sources. Results depend on available data. Does not perform active scanning. Rate limits may apply.

findomain was created by Eduard Tolosa as a fast subdomain enumeration tool. Written in Rust for performance, it emerged as an alternative to tools like Sublist3r and Amass. The project focuses on speed and reliability in passive reconnaissance.

amass(1), subfinder(1), sublist3r(1), dnsx(1)