subfinder.md

Source

https://github.com/projectdiscovery/subfinder

Find domains using OSINT

subfinder -d <domain>

OSINT sources without API key

alienvault
anubis
commoncrawl
crtsh
digitorus
dnsdumpster
gitlab
hackertarget
leakix
netlas
rapiddns
reconcloud
redhuntlabs
riddler
sitedossier
threatminer
waybackarchive

OSINT sources with API key

bevigil
binaryedge
bufferover
builtwith
c99
censys
certspotter
chaos
chinaz
dnsdb
dnsrepo
facebook
fofa
fullhunt
github
hunterio
intelx
passivetotal
quake
robtex
securitytrails
shodan
threatbook
virustotal
whoisxml
zoomeye

API setup

Path to config:
$HOME/.config/subfinder/provider-config.yaml

Example:
binaryedge: [apiKey]