Crobat
Subdomain enumeration using SonarDNS data
Recon & OSINT4 commands
#subdomain#sonar#recon#osint
Installation
1Install Go 1.16+ on your system
2Run the Go install command
3Verify installation
go install github.com/cgboal/sonarsearch/cmd/crobat@latest
# Verify
crobat -hBasic Usage
Crobat queries the SonarDNS dataset from Project Sonar (Rapid7) to find subdomains with known DNS records
# Basic search
crobat -s example.com
# Output to file
crobat -s example.com -o results.txt
# JSON format
crobat -s example.com -o results.json -j
# Multiple domains from file
crobat -sL domains.txtCommand Reference
4 commands
1Target domain to search
-s2File with list of domains
-sL3Output file path
-o4JSON output format
-jWhen to Use
1
Leveraging Rapid7's Project Sonar DNS dataset2
Validating subdomains with known DNS records3
Finding subdomains missed by other passive tools4
Historical DNS reconnaissanceNotes & Tips
1
Dataset sourced from Rapid7's Project Sonar — updated regularly2
Results are subdomains that had DNS records at scan time3
May not include very new subdomains — depends on scan cadence4
No API key required for basic usageCommon Errors & Solutions
No results found
The domain may not have subdomains in the Sonar dataset; try other sources
API endpoint unreachable
Check internet connectivity; the Sonar API may be temporarily down