Command-line tool that finds domains and subdomains potentially related to a given domain using passive sources.
assetfinder {domain} 🌍 domain → example.com assetfinder {domain}Sandbox: execFile · Timeout: 120s
network.discovery.subdomain security.recon.passive network.discovery.domain | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
domain | string | Yes | - | Target domain to find assets for | - |
subs-only | boolean | No | - | Only show subdomains, exclude related domains | --subs-only |
flag-f | boolean | No | false | Filter out unverified domains | -f, --filter |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
security.recon.domain.list | List of related domains and subdomains | text/plain | - | verified |
Inputs
network.target.domain Target domain name
Outputs
security.recon.domain.list Related domains and subdomains
network_traffic Produces
security.recon.domain.listConsumes
network.target.domain| Resource | Value |
|---|---|
| CPU | low |
| Memory | 32 MB |
| Network | low |
| Disk I/O | low |
Basic domain asset discovery
assetfinder example.comShow only subdomains (exclude related domains)
assetfinder --subs-only example.comFilter output for verified domains only
assetfinder --subs-only example.com | sort -uAssetfinder is a lightweight tool that finds domains and subdomains potentially related to a given domain. It sources data from certificate transparency logs, DNS records, and other public intelligence sources.
# Basic discovery
assetfinder example.com
# Subdomains only
assetfinder --subs-only example.com
# Pipe to httpx for live host verification
assetfinder example.com | httpx -silent