assetfindergithub.com
Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.
domaindetails
tools / subfinder
subfinder
Fast passive subdomain enumeration CLI that aggregates dozens of sources (CT logs, passive DNS, search engines) without touching the target.
freeacct optionalosscli
field note
Add free API keys (SecurityTrails, Censys, VirusTotal, etc.) to provider-config.yaml. Coverage improves a lot.
used in playbooks
similar tools
BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
theHarvestergithub.com
Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.
domaincompanydetails
C99 Subdomain Findersubdomainfinder.c99.nl
Free web-based subdomain finder that returns subdomains with their resolved IPs and Cloudflare status. Previous scans are browsable.
domaindetails
crt.shcrt.sh
Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.
domaincompanydetails
DNSDumpsterdnsdumpster.com
Free domain research tool from HackerTarget that maps DNS records, subdomains, hosts and mail servers from passive sources and draws a network graph.
domaindetails