NAME

findomain - manual page for findomain 10.0.1

SYNOPSIS

findomain [OPTIONS]

DESCRIPTION

The fastest and cross-platform subdomain enumerator, do not waste your time.

OPTIONS

-t, --target <TARGET>

Target host

-r, --resolved

Show/write only resolved subdomains

-i, --ip

Show/write the ip address of resolved subdomains

-f, --file <FILES>

Use a list of subdomains writen in a file as input

-o, --output

Write to an automatically generated output file. The name of the output file is generated using the format: target.txt. If you want a custom output file name, use the -u/--unique-output option

-u, --unique-output <UNIQUE_OUTPUT>

Write all the results for a target or a list of targets to a specified filename

-m, --monitoring-flag

Activate Findomain monitoring mode

--postgres-user <POSTGRES_USER>

Postgresql username

--postgres-password <POSTGRES_PASSWORD>

Postgresql password

--postgres-host <POSTGRES_HOST>

Postgresql host

--postgres-port <POSTGRES_PORT>

Postgresql port

--postgres-database <POSTGRES_DATABASE>

Postgresql database

-q, --quiet

Remove informative messages but show fatal errors or subdomains not found message

--query-database

Query the findomain database to search subdomains that have already been discovered

--import-subdomains <IMPORT_SUBDOMAINS>

Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import

--enable-dot

Enable DNS over TLS for resolving subdomains IPs

--ipv6-only

Perform a IPv6 lookup only

--threads <THREADS>

Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Deprecated option, use --lighweight-threads instead. This would be removed in the future

--lightweight-threads <LIGHTWEIGHT_THREADS>

Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Default is 50

--screenshots-threads <SCREENSHOTS_THREADS>

Number of threads to use to use for taking screenshots. Default is 10

--parallel-ip-ports-scan <PARALLEL_IP_PORTS_SCAN>

Number of IPs that will be port-scanned at the same time. Default is 10

--tcp-connect-threads <TCP_CONNECT_THREADS>

Number of threads to use for TCP connections - It's the equivalent of Nmap's --min-rate. Default is 500

--resolvers <CUSTOM_RESOLVERS>

Path to a file (or files) containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used

--aempty

Send alert to webhooks still when no new subdomains have been found

-x, --as-resolver

Use Findomain as resolver for a list of domains in a file

-w, --wordlist <WORDLISTS>

Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode

--no-wildcards

Disable wilcard detection when resolving subdomains

--filter <STRING_FILTER>

Filter subdomains containing specifics strings

--exclude <STRING_EXCLUDE>

Exclude subdomains containing specifics strings

--exclude-sources <EXCLUDE_SOURCES>

Exclude sources from searching subdomains in [possible values: certspotter, crtsh, sublist3r, facebook, spyse, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer, c99, bufferover_free, bufferover_paid]

--http-status

Check the HTTP status of subdomains

-c, --config <CONFIG_FILE>

Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml

--rate-limit <RATE_LIMIT>

Set the rate limit in seconds for each target during enumeration

--pscan

Enable port scanner

--iport <INITIAL_PORT>

Initial port to scan. Default 0

--lport <LAST_PORT>

Last port to scan. Default 1000

-v, --verbose

Enable verbose mode (useful to debug problems)

--mtimeout

Allow Findomain to insert data in the database when the webhook returns a timeout error

--no-monitor

Disable monitoring mode while saving data to database

-s, --screenshots <SCREENSHOTS_PATH>

Path to save the screenshots of the HTTP(S) website for subdomains with active ones

--sandbox

Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option

-j, --jobname <JOBNAME>

Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option

--query-jobname

Extract all the subdomains from the database where the job name is the specified using the jobname option

--http-timeout <HTTP_TIMEOUT>

Value in seconds for the HTTP Status check of subdomains. Default 5

--tcp-connect-timeout <TCP_CONNECT_TIMEOUT>

Value in milliseconds to wait for the TCP connection (ip:port) in the ports scanning function. Default 2000

--stdin

Read from stdin instead of files or aguments

--ua <USER_AGENTS_FILE>

Path to file containing user agents strings

--randomize

Enable randomization when reading targets from files

--no-resolve

Disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots

--external-subdomains

Get external subdomains with amass and subfinder

--validate

Validate all the subdomains from the specified file

--resolver-timeout <RESOLVER_TIMEOUT>

Timeout in seconds for the resolver. Default 1

--http-retries <HTTP_RETRIES>

Number of retries for the HTTP Status check of subdomains. Default 1

--double-dns-check

Enable double DNS check. This means that the subdomains that report an IP address are checked again using a list of trustable resolvers to avoid false-positives. Only applies when using custom resolvers

-n, --no-discover

Prevent findomain from searching subdomains itself. Useful when you are importing subdomains from other tools

--max-http-redirects <MAX_HTTP_REDIRECTS>

Maximum number of HTTP redirects to follow. Default 0

--reset-database

Reset the database. It will delete all the data from the database

-h, --help

Print help

-V, --version

Print version

SEE ALSO

The full documentation for findomain is maintained as a Texinfo manual. If the info and findomain programs are properly installed at your site, the command

info findomain

should give you access to the complete manual.