Findomain — Reconnaissance | Tools

Description

Findomain is one of the fastest subdomain enumeration tools available. Built in Rust for maximum performance, it queries multiple certificate transparency logs and APIs simultaneously. It features monitoring mode for continuous subdomain discovery, making it ideal for ongoing bug bounty programs.

Installation

                        BASH
                        
                            # Pre-compiled binary (Linux)
curl -LO https://github.com/Findomain/Findomain/releases/latest/download/findomain-linux.zip
unzip findomain-linux.zip && chmod +x findomain && sudo mv findomain /usr/local/bin/

# Cargo (Rust)
cargo install findomain

# macOS
brew install findomain

# Arch Linux
sudo pacman -S findomain

Basic Usage

                        BASH
                        
                            # Enumerate subdomains for a single target
findomain -t target.com

# Output to file
findomain -t target.com -o

# Multiple targets from file
findomain -f domains.txt

# Quiet mode (subdomains only)
findomain -t target.com -q

Advanced Usage

                        BASH
                        
                    

                            # Resolve subdomains and show IP addresses
findomain -t target.com -r

# Monitor mode — detect new subdomains over time
findomain -t target.com --monitoring-flag

# Custom output file
findomain -t target.com -u results.txt

# Use specific API keys for extended results
export findomain_virustotal_token="YOUR_VT_KEY"
export findomain_securitytrails_token="YOUR_ST_KEY"
findomain -t target.com

# JSON output
findomain -t target.com --json

# Filter by specific resolver
findomain -t target.com -r --resolvers 8.8.8.8,1.1.1.1
                        

Common Workflows

                        BASH
                        
                            # Full recon pipeline
findomain -t target.com -q | httpx -silent | nuclei -t cves/

# Subdomain monitoring with Slack alerts
findomain -t target.com --monitoring-flag \
  --slack-webhook https://hooks.slack.com/services/xxx

# Combine with other enumerators for max coverage
(findomain -t target.com -q; subfinder -d target.com -silent; amass enum -passive -d target.com) | sort -u > all_subs.txt