findomain: fast passive subdomain enumeration
Findomain · GPL-3.0
findomain is a passive subdomain enumerator written in Rust. It queries certificate transparency logs and a set of public APIs and returns hostnames. Functionally it overlaps with subfinder; the reason to run both is that their source lists differ.
Install
# binary release
curl -LO https://github.com/Findomain/Findomain/releases/latest/download/findomain-linux.zip
unzip findomain-linux.zip && chmod +x findomain && sudo mv findomain /usr/local/bin/
# from source
cargo install --git https://github.com/Findomain/FindomainCore commands
# a single target
findomain -t example.com -q
# from a file of roots
findomain -f roots.txt -q -u subs.txt
# resolve as it goes
findomain -t example.com -r -q
# only hosts that respond over HTTP
findomain -t example.com -i -q-q is quiet mode: hostnames only, no banner, pipes cleanly.
Output
Plain hostnames, one per line. With -r, the resolved address is appended.
Where it sits in Tandera
findomain runs in discovery on recon_web_lite and recon_web_full, alongside subfinder and cero.
Three producers is a deliberate choice. Passive sources are incomplete in different ways: certificate transparency sees anything that was ever issued a certificate, passive DNS sees what was resolved, and search-based sources see what was linked. Tandera merges the three and deduplicates, because the union is consistently larger than the best single source.
Using it in a pentest
Do not treat overlap as waste. If findomain returns nothing subfinder missed on one engagement, it will on the next. The cost is seconds; the cost of missing a host is the finding you did not make.
Resolve before you report. -r gives you resolution inline, but the pipeline discipline is the same as always: passive output is a claim until DNS confirms it.
Rate limits are real. The free API tiers throttle. On a large root list, findomain will silently return less than it could. Check the count against your other producers and rerun if one looks anomalously thin.