Follow in Twitter:
The fastest and cross-platform subdomain enumerator.
It comparision gives you a idea why you should use findomain instead of another tools. The domain used for the test was microsoft.com in the following BlackArch virtual machine:
Host: KVM/QEMU (Standard PC (i440FX + PIIX, 1996) pc-i440fx-3.1)
Kernel: 5.2.6-arch1-1-ARCH
CPU: Intel (Skylake, IBRS) (4) @ 2.904GHz
Memory: 139MiB / 3943MiB
The tool used to calculate the time, is the time command in Linux. You can see all the details of the tests in it link.
|Enumeration Tool|Serch Time|Total Subdomains Found|CPU Usage|RAM Usage| |---|---|---|---|---| |Findomain|real 0m38.701s|5622|Very Low|Very Low| |assetfinder|real 6m1.117s|4630|Very Low|Very Low| |Subl1st3r|real 7m14.996s|996|Low|Low| |Amass*|real 29m20.301s|332|Very Hight|Very Hight|
Note: The benchmark was made the 10/08/2019, since it point other tools can improve things and you will got different results.
Note: the proxy support is just to proxify APIs requests, the actual implementation to discover IP address of subdomains doesn't support proxyfing and it's made using the host network still if you use the -p option.
It tool doesn't use the common methods for sub(domains) discover, the tool uses Certificate Transparency logs to find subdomains and it method make it tool the most faster and reliable. The tool make use of multiple public available APIs to perform the search. If you want to know more about Certificate Transparency logs, read https://www.certificate-transparency.org/
APIs that we are using at the moment:
If you know other that should be added, open an issue.
All supported platforms in the binarys that we give are 64 bits only and we don't have plans to add support for 32 bits binary releases, if you want to have support for 32 bits follow the documentation.
If you want to build the tool for your 32 bits system or another platform, follow it steps:
Note: You need to have rust, make and perl installed in your system first.
Using the crate:
cargo install findomain$HOME/.cargo/bin. See the cargo-install documentation.Using the Github source code:
cargo build --releasetarget/release/findomain and you can use it.Install the Termux package, open it and follow it commands:
$ pkg install rust make perl
$ cargo install findomain
$ cd $HOME/.cargo/bin
$ ./findomain
If you want to install it, you can do that manually compiling the source or using the precompiled binary.
Manually: You need to have rust, make and perl installed in your system first.
$ git clone https://github.com/Edu4rdSHL/findomain.git
$ cd findomain
$ cargo build --release
$ sudo cp target/release/findomain /usr/bin/
$ findomain
$ wget https://github.com/Edu4rdSHL/findomain/releases/latest/download/findomain-linux
$ chmod +x findomain-linux
$ ./findomain-linux
If you are using the BlackArch Linux distribution, you just need to use:
$ sudo pacman -S findomain
$ wget https://github.com/Edu4rdSHL/findomain/releases/latest/download/findomain-arm
$ chmod +x findomain-arm
$ ./findomain-arm
$ wget https://github.com/Edu4rdSHL/findomain/releases/latest/download/findomain-aarch64
$ chmod +x findomain-aarch64
$ ./findomain-aarch64
Download the binary from https://github.com/Edu4rdSHL/findomain/releases/latest/download/findomain-windows.exe
Open a CMD shell and go to the dir where findomain-windows.exe was downloaded.
Exec: findomain-windows in the CMD shell.
$ wget https://github.com/Edu4rdSHL/findomain/releases/latest/download/findomain-osx
$ chmod +x findomain-osx.dms
$ ./findomain-osx.dms
History
When I added the Facebook CT API in the beginning I was providing a Webhook token to search in the API, as consecuence when a lot of users were using the same token the limit was reached and user can't search in the Facebook API anymore until Facebook unlocked it again. Since Findomain version 0.2.3, users can set their own Facebook Access Token for the webook and pass it to findomain setting the findomain_fb_token system variable.
Getting the Webhook token
The first step is get your Facebook application token. You need to create a Webhook, follow the next steps:
Note: replace your-app-id by the number of your webhook identifier and your-secret-key for the key that you got in the 4th step.
json
{
"access_token": "xxxxxxxxxx|yyyyyyyyyyyyyyyyyyyyyyy",
"token_type": "bearer"
}
Save the access_token value.
Now you can use that value to set the access token as following:
Unix based systems (Linux, BSD, MacOS, Android with Termux, etc):
Put in your terminal:
$ findomain_fb_token="YourAccessToken" findomain -(options)
Windows systems:
Put in the CMD command prompt:
```
set findomainfbtoken=YourAccessToken && findomain -(options) ```
Note: In Windows you need to scape special characters like |, add ^ before the special character to scape it and don't quote the token. Example: findomain_fb_token=xxxxxxx^|yyyyyyyy && findomain -(options)
Tip: If you don't want to write the access token everytime that you run findomain, add an alias in Unix based systems like alias findomain=findomain_fb_token="YourAccessToken" findomain and set the findomain_fb_token variable in your Windows system as described here.
You can use the tool in two ways, only discovering the domain name or discovering the domain + the IP address.
``` findomain 0.2.0 Eduard Tolosa tolosaeduard@gmail.com A tool that use Certificates Transparency logs to find subdomains.
USAGE: findomain [FLAGS] [OPTIONS]
FLAGS: -a, --all-apis Use all the available APIs to perform the search. It take more time but you will have a lot of more results. -h, --help Prints help information -i, --get-ip Return the subdomain list with IP address if resolved. -V, --version Prints version information
OPTIONS:
-f, --file
findomain -t example.com
findomain -t example.com -a
findomain -t example.com -o csv
findomain -t example.com -a -o csv
findomain -t example.com -i
findomain -t example.com -i -a
findomain -t example.com -i -a -o csv
findomain -t example.com -p http://127.0.0.1:8080
If you have a problem or a feature request, open an issue.
