Assetfinder
Find domains and subdomains by passive sources
Recon & OSINT3 commands
#subdomain#recon#osint#passive
Installation
1Install Go 1.16+ on your system
2Run the Go install command
3Verify installation
go install github.com/tomnomnom/assetfinder@latest
# Verify
assetfinder -hBasic Usage
Assetfinder uses passive sources like crt.sh, CertSpotter, and DNSDumpster to find subdomains
# Basic scan for subdomains only
assetfinder --subs-only example.com
# Full output (includes related domains)
assetfinder example.com
# Pipe to httpx for live host filtering
assetfinder --subs-only example.com | httpx -silentCommand Reference
3 commands
1Show subdomains only, exclude related domains
--subs-only2Enable verbose output
-v3Show help
-hWhen to Use
1
Quick passive subdomain recon2
Lightweight enumeration without API keys3
Generating input for httpx or other tools4
Initial phase of bug bounty reconNotes & Tips
1
No API keys required — uses only public sources2
Results from crt.sh can be stale3
For deeper results, combine with subfinder or amass4
Output is one subdomain per line, easy to pipeCommon Errors & Solutions
No results returned
Check internet connectivity; some sources may be temporarily down
Go not found
Install Go from https://go.dev/dl/ and ensure GOPATH/bin is in your PATH