FINDOMAIN(1)

💅 FINDOMAIN(1) — the group chat version 🎀

okay so bestie, listen. this is the manual page for findomain 10.0.1, a User Commands situation, and honestly? she ate. let's get into it ✨

🌸 NAME 🌸

findomain — the manual page for findomain 10.0.1. that's her. that's the girl. 👑

🦋 SYNOPSIS 🦋

findomain [OPTIONS]

💖 DESCRIPTION 💖

the fastest and cross-platform subdomain enumerator, no cap. do not waste your time. like literally, don't. she's fast, she's cross-platform, she's the main character of subdomain enumeration. periodt. 🔥

✨ OPTIONS ✨

okay this is the long part, grab a snack 🍓

• -t, --target <TARGET> — the target host you wanna go after. that's the one.
• -r, --resolved — show/write only the resolved subdomains. filter the noise, keep the real ones 💅
• -i, --ip — show/write the IP address of the resolved subdomains. now you know where they live 🏠
• -f, --file <FILES> — use a list of subdomains written in a file as input. (yes, the manpage says "writen", we're keeping the vibe.)
• -o, --output — write to an automatically generated output file. the name gets generated using the format: target.txt. want a custom name instead? that's what -u/--unique-output is for 🎀
• -u, --unique-output <UNIQUE_OUTPUT> — write all the results for a target or a list of targets to a specified filename. your name, your rules ✨
• -m, --monitoring-flag — activate Findomain monitoring mode 👀
• --postgres-user <POSTGRES_USER> — Postgresql username
• --postgres-password <POSTGRES_PASSWORD> — Postgresql password 🤫
• --postgres-host <POSTGRES_HOST> — Postgresql host
• --postgres-port <POSTGRES_PORT> — Postgresql port
• --postgres-database <POSTGRES_DATABASE> — Postgresql database
• -q, --quiet — remove informative messages, but still show fatal errors or the "subdomains not found" message. she's quiet, not silent 💀
• --query-database — query the findomain database to search subdomains that have already been discovered. recycling era ♻️
• --import-subdomains <IMPORT_SUBDOMAINS> — import subdomains from one or multiple files. subdomains need to be one per line in the file to import, iykyk
• --enable-dot — enable DNS over TLS for resolving subdomains IPs 🔐
• --ipv6-only — perform an IPv6 lookup only. v6 girlies rise 🌈
• --threads <THREADS> — number of threads to use for lightweight tasks such as IP discovery and HTTP checks. ⚠️ deprecated option, use --lighweight-threads instead. this would be removed in the future. (yes the manpage spells it --lighweight-threads, we don't fix it, we respect it)
• --lightweight-threads <LIGHTWEIGHT_THREADS> — number of threads to use for lightweight tasks such as IP discovery and HTTP checks. default is 50 💨
• --screenshots-threads <SCREENSHOTS_THREADS> — number of threads to use to use for taking screenshots. default is 10. (double "to use", iconic, not touching it) 📸
• --parallel-ip-ports-scan <PARALLEL_IP_PORTS_SCAN> — number of IPs that will be port-scanned at the same time. default is 10 🔍
• --tcp-connect-threads <TCP_CONNECT_THREADS> — number of threads to use for TCP connections — it's the equivalent of Nmap's --min-rate. default is 500 🚀
• --resolvers <CUSTOM_RESOLVERS> — path to a file (or files) containing a list of DNS IP address. if none specified then Google, Cloudflare and Quad9 DNS servers are used 🌍
• --aempty — send alert to webhooks still when no new subdomains have been found. empty-handed but still texting 📭
• -x, --as-resolver — use Findomain as resolver for a list of domains in a file
• -w, --wordlist <WORDLISTS> — wordlist file to use in the bruteforce process. using this option automatically enables bruteforce mode 😤
• --no-wildcards — disable wildcard detection when resolving subdomains 🃏
• --filter <STRING_FILTER> — filter subdomains containing specific strings. keep only what matches 💖
• --exclude <STRING_EXCLUDE> — exclude subdomains containing specific strings. bye bestie 👋
• --exclude-sources <EXCLUDE_SOURCES> — exclude sources from searching subdomains in. possible values: certspotter, crtsh, sublist3r, facebook, spyse, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer, c99, bufferover_free, bufferover_paid
• --http-status — check the HTTP status of subdomains 🚦
• -c, --config <CONFIG_FILE> — use a configuration file. the default configuration file is findomain and the format can be toml, json, hjson, ini or yml 📝
• --rate-limit <RATE_LIMIT> — set the rate limit in seconds for each target during enumeration. slow down, she's worth it 🐢
• --pscan — enable port scanner 🔎
• --iport <INITIAL_PORT> — initial port to scan. default 0
• --lport <LAST_PORT> — last port to scan. default 1000
• -v, --verbose — enable verbose mode (useful to debug problems) 🐛
• --mtimeout — allow Findomain to insert data in the database when the webhook returns a timeout error ⏰
• --no-monitor — disable monitoring mode while saving data to database
• -s, --screenshots <SCREENSHOTS_PATH> — path to save the screenshots of the HTTP(S) website for subdomains with active ones 📷
• --sandbox — enable Chrome/Chromium sandbox. it is disabled by default because a big number of users run the tool using the root user by default. ⚠️ make sure you are not running the program as root user before using this option 🚨
• -j, --jobname <JOBNAME> — use an database identifier for jobs. it is useful when you want to relate different targets into a same job name. to extract the data by job name identifier, use the query-jobname option 🏷️
• --query-jobname — extract all the subdomains from the database where the job name is the specified using the jobname option
• --http-timeout <HTTP_TIMEOUT> — value in seconds for the HTTP status check of subdomains. default 5 ⏳
• --tcp-connect-timeout <TCP_CONNECT_TIMEOUT> — value in milliseconds to wait for the TCP connection (ip:port) in the ports scanning function. default 2000 ⌛
• --stdin — read from stdin instead of files or aguments. (manpage says "aguments", she's quirky, we love her) ⌨️
• --ua <USER_AGENTS_FILE> — path to file containing user agents strings 🕵️‍♀️
• --randomize — enable randomization when reading targets from files 🎲
• --no-resolve — disable pre-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots
• --external-subdomains — get external subdomains with amass and subfinder 🤝
• --validate — validate all the subdomains from the specified file ✅
• --resolver-timeout <RESOLVER_TIMEOUT> — timeout in seconds for the resolver. default 1
• --http-retries <HTTP_RETRIES> — number of retries for the HTTP status check of subdomains. default 1 🔁
• --double-dns-check — enable double DNS check. this means that the subdomains that report an IP address are checked again using a list of trustable resolvers to avoid false-positives. only applies when using custom resolvers 💯
• -n, --no-discover — prevent findomain from searching subdomains itself. useful when you are importing subdomains from other tools 🧺
• --max-http-redirects <MAX_HTTP_REDIRECTS> — maximum number of HTTP redirects to follow. default 0 ↪️
• --reset-database — reset the database. 💀 it will delete all the data from the database. like gone gone.
• -h, --help — print help 🫶
• -V, --version — print version 🎀

⭐ SEE ALSO ⭐

the full documentation for findomain is maintained as a Texinfo manual. if the info and findomain programs are properly installed at your site, the command

info findomain

should give you access to the complete manual. go read it, it's giving lore 📚✨

and that's the whole thing, bestie! 🦋 this page is from findomain 10.0.1, dated July 2025 — mwah, iconic, no notes 💜💅