FINDOMAIN(1)

NAME
findomain - manual page for findomain 10.0.1

SYNOPSIS
findomain [OPTIONS]

DESCRIPTION
The fastest and cross-platform subdomain enumerator, do not waste your time.

OPTIONS

-t, --target <TARGET>

    Target host

-r, --resolved

    Show/write only resolved subdomains

-i, --ip

    Show/write the ip address of resolved subdomains

-f, --file <FILES>

    Use a list of subdomains writen in a file as input

-o, --output

    Write to an automatically generated output file. The name of the output file is generated using the format: target.txt. If you want a custom output file name, use the -u/--unique-output option

-u, --unique-output <UNIQUE_OUTPUT>

    Write all the results for a target or a list of targets to a specified filename

-m, --monitoring-flag

    Activate Findomain monitoring mode

--postgres-user <POSTGRES_USER>

    Postgresql username

--postgres-password <POSTGRES_PASSWORD>

    Postgresql password

--postgres-host <POSTGRES_HOST>

    Postgresql host

--postgres-port <POSTGRES_PORT>

    Postgresql port

--postgres-database <POSTGRES_DATABASE>

    Postgresql database

-q, --quiet

    Remove informative messages but show fatal errors or subdomains not found message

--query-database

    Query the findomain database to search subdomains that have already been discovered

--import-subdomains <IMPORT_SUBDOMAINS>

    Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import

--enable-dot

    Enable DNS over TLS for resolving subdomains IPs

--ipv6-only

    Perform a IPv6 lookup only

--threads <THREADS>

    Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Deprecated option, use --lighweight-threads instead. This would be removed in the future

--lightweight-threads <LIGHTWEIGHT_THREADS>

    Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Default is 50

--screenshots-threads <SCREENSHOTS_THREADS>

    Number of threads to use to use for taking screenshots. Default is 10

--parallel-ip-ports-scan <PARALLEL_IP_PORTS_SCAN>

    Number of IPs that will be port-scanned at the same time. Default is 10

--tcp-connect-threads <TCP_CONNECT_THREADS>

    Number of threads to use for TCP connections - It's the equivalent of Nmap's --min-rate. Default is 500

--resolvers <CUSTOM_RESOLVERS>

    Path to a file (or files) containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used

--aempty

    Send alert to webhooks still when no new subdomains have been found

-x, --as-resolver

    Use Findomain as resolver for a list of domains in a file

-w, --wordlist <WORDLISTS>

    Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode

--no-wildcards

    Disable wilcard detection when resolving subdomains

--filter <STRING_FILTER>

    Filter subdomains containing specifics strings

--exclude <STRING_EXCLUDE>

    Exclude subdomains containing specifics strings

--exclude-sources <EXCLUDE_SOURCES>

    Exclude sources from searching subdomains in [possible values: certspotter, crtsh, sublist3r, facebook, spyse, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer, c99, bufferover_free, bufferover_paid]

--http-status

    Check the HTTP status of subdomains

-c, --config <CONFIG_FILE>

    Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml

--rate-limit <RATE_LIMIT>

    Set the rate limit in seconds for each target during enumeration

--pscan

    Enable port scanner

--iport <INITIAL_PORT>

    Initial port to scan. Default 0

--lport <LAST_PORT>

    Last port to scan. Default 1000

-v, --verbose

    Enable verbose mode (useful to debug problems)

--mtimeout

    Allow Findomain to insert data in the database when the webhook returns a timeout error

--no-monitor

    Disable monitoring mode while saving data to database

-s, --screenshots <SCREENSHOTS_PATH>

    Path to save the screenshots of the HTTP(S) website for subdomains with active ones

--sandbox

    Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option

-j, --jobname <JOBNAME>

    Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query-jobname option

--query-jobname

    Extract all the subdomains from the database where the job name is the specified using the jobname option

--http-timeout <HTTP_TIMEOUT>

    Value in seconds for the HTTP Status check of subdomains. Default 5

--tcp-connect-timeout <TCP_CONNECT_TIMEOUT>

    Value in milliseconds to wait for the TCP connection (ip:port) in the ports scanning function. Default 2000

--stdin

    Read from stdin instead of files or aguments

--ua <USER_AGENTS_FILE>

    Path to file containing user agents strings

--randomize

    Enable randomization when reading targets from files

--no-resolve

    Disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots

--external-subdomains

    Get external subdomains with amass and subfinder

--validate

    Validate all the subdomains from the specified file

--resolver-timeout <RESOLVER_TIMEOUT>

    Timeout in seconds for the resolver. Default 1

--http-retries <HTTP_RETRIES>

    Number of retries for the HTTP Status check of subdomains. Default 1

--double-dns-check

    Enable double DNS check. This means that the subdomains that report an IP address are checked again using a list of trustable resolvers to avoid false-positives. Only applies when using custom resolvers

-n, --no-discover

    Prevent findomain from searching subdomains itself. Useful when you are importing subdomains from other tools

--max-http-redirects <MAX_HTTP_REDIRECTS>

    Maximum number of HTTP redirects to follow. Default 0

--reset-database

    Reset the database. It will delete all the data from the database

-h, --help

    Print help

-V, --version

    Print version

SEE ALSO
The full documentation for findomain is maintained as a Texinfo manual. If the info and findomain programs are properly installed at your site, the command

    info findomain

should give you access to the complete manual.