assetfinder

assetfinder [--subs-only] domain

assetfinder discovers domains and subdomains related to a target organization. It queries various sources including certificate transparency logs, DNS databases, and web archives to find associated assets.The tool is useful for reconnaissance in security assessments and for discovering an organization's external attack surface.

--subs-only

Only show subdomains

Target domain to investigate

Some data sources need API credentials, supplied through environment variables:FB_APP_ID, FB_APP_SECRET

Facebook application credentials for the Facebook certificate transparency source.

VirusTotal API key.

Spyse (findsubdomains) API token.

Passive reconnaissance only; generates no traffic to target. Results depend on public data sources. May include old or inactive domains.

assetfinder was created by Tom Hudson (tomnomnom) as a fast, simple subdomain discovery tool for security reconnaissance.

amass(1), subfinder(1), findomain(1)

Source code