Assetfinder Cheat Sheet
Find domains and subdomains related to a given domain using passive sources (Tom Hudson).
Overview
Assetfinder returns hostnames related to a target domain by querying passive sources (crt.sh, various APIs when configured). Lightweight and ideal for chaining in shell one-liners with other enum tools.
Authorized testing only. Queries passive intelligence sources; ensure target domain is in scope for the engagement or bug bounty program.
Install
go install github.com/tomnomnom/assetfinder@latestassetfinder --helpEssential commands
Subdomains for domain
assetfinder target.example.comInclude parent domain in output
assetfinder --subs-only target.example.comMultiple domains
cat domains.txt | assetfinder --subs-onlyCommon workflows
Merge with subfinder / amass —
{subfinder -d target.example.com -silentassetfinder --subs-only target.example.comamass enum -passive -d target.example.com} | sort -u | httpx -silent -o live.txtScope filter (manual) —
assetfinder target.example.com | grep '\.target\.example\.com$' | tee subs.txtFlags reference
--subs-only | Subdomains only (exclude parent) |
|---|---|
(stdin) | Pass domains one per line |
Tips
- Set API-related env vars if using extended sources (see project README).
- Very fast—use as first pass before heavier amass enum.
- Always dedupe and verify ownership before scanning (httpx, nuclei).
- Does not replace active DNS brute force for hidden names.