security enabled verified low v1.0.0

sublist3r

OSINT subdomain enumeration tool that uses search engines, DNS services, and certificate transparency logs to discover subdomains of a target domain.

📋 Live Preview

sublist3r {flag-verbose} {flag-no-color} {flag-bruteforce} {flag-threads} {flag-ports} {flag-engines} {flag-output} -d {domain}

📎 flag-verbose 📎 flag-no-color 📎 flag-bruteforce 📎 flag-threads 📎 flag-ports 📎 flag-engines 📎 flag-output 📎 domain

sublist3r {flag-verbose} {flag-no-color} {flag-bruteforce} {flag-threads} {flag-ports} {flag-engines} {flag-output} -d {domain}

Sandbox: execFile · Timeout: 300s

Capabilities

dns.enum.subdomain

osint.discovery.subdomain

osint.search.engine

Parameters

Name	Type	Required	Default	Description	Aliases
`domain`	string	Yes	-	Target domain name	`-d`, `--domain`
`flag-ports`	string	No	-	Ports to scan for HTTP/HTTPS on discovered subdomains	`-p`, `--ports`
`flag-threads`	integer	No	-	Number of threads for enumeration	`-t`, `--threads`
`flag-engines`	string	No	-	Comma-separated list of search engines to use	`-e`, `--engines`
`flag-no-color`	boolean	No	-	Disable colored output	`-n`, `--no-color`
`flag-bruteforce`	boolean	No	-	Enable subdomain bruteforce	`-b`, `--bruteforce`
`flag-output`	string	No	-	Output file for results	`-o`, `--output`
`flag-verbose`	boolean	No	-	Verbose output	`-v`, `--verbose`

Artifacts

Type	Description	MIME	Schema	Trust
`dns.subdomain.list`	Discovered subdomains list	text/plain	-	verified

Contract

Inputs

domain.name

Target domain name

Outputs

dns.subdomain.list

List of discovered subdomains

Side effects: network_traffic

Workflow Edges

Produces

dns.subdomain.list

Consumes

domain.name

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	low
Disk I/O	low

Examples

Basic subdomain enumeration

sublist3r -d example.com

Save results to file with verbose output

sublist3r -d example.com -o subdomains.txt -v

Use specific search engines only

sublist3r -d example.com -e baidu,yahoo,google

Enable bruteforce with 50 threads

sublist3r -d example.com -b -t 50

Documentation

Sublist3r — Subdomain Enumeration Tool

Sublist3r is an OSINT-based subdomain enumeration tool designed for penetration testers and security researchers. It leverages multiple search engines (Google, Yahoo, Bing, Baidu, Ask) and other sources like Netcraft, DNSDumpster, and VirusTotal to discover subdomains.

Usage

# Basic enumeration
sublist3r -d example.com

# Save to file
sublist3r -d example.com -o subdomains.txt

# Enable bruteforce
sublist3r -d example.com -b

# Specify engines
sublist3r -d example.com -e google,yahoo

# Increase threads
sublist3r -d example.com -t 100

Dependencies

python3

Related Tools

amasssubfinderassetfinderdnsreconfierce

References

Sublist3r GitHub