Post cover image

August 3, 2026

Sublist3r

Sublist3r is an open-source subdomain enumeration tool developed by Aboul3la. It discovers subdomains using multiple public search engines…

By Om Barot

10 min read

Sublist3r is an open-source subdomain enumeration tool developed by Aboul3la. It discovers subdomains using multiple public search engines, OSINT services, and certificate transparency sources. It primarily performs passive enumeration but also supports optional brute-force enumeration to discover additional subdomains.

Purpose

The primary purpose of Sublist3r is to discover subdomains associated with a target domain using publicly available OSINT sources. It helps security professionals expand the target's attack surface during the reconnaissance phase.

Key Features

  • Passive subdomain enumeration
  • Multiple search engine support
  • Certificate Transparency lookups
  • Optional brute-force enumeration
  • Optional port scanning
  • Supports search engine aggregation
  • Open source
  • Cross-platform support
  • Simple command-line interface

Passive / Active Enumeration

Sublist3r primarily performs passive enumeration by querying publicly available search engines and OSINT sources.

It also supports optional active enumeration through brute-force techniques, allowing it to discover additional subdomains that may not be publicly indexed.

Data Sources

Sublist3r collects information from multiple publicly available sources, including:

  • Google
  • Bing
  • Yahoo
  • Baidu
  • Ask
  • Netcraft
  • VirusTotal
  • ThreatCrowd
  • DNSDumpster
  • crt.sh (Certificate Transparency)

The available sources may vary depending on the tool version and the availability of external services.

Advantages

  • Easy to use
  • Supports multiple search engines
  • Can combine results from various OSINT sources
  • Optional brute-force enumeration
  • Open source and free
  • Useful for reconnaissance and bug bounty workflows

Limitations

  • Development is less active than modern alternatives like Subfinder.
  • Depends on third-party search engines and OSINT services.
  • Some sources may block or rate-limit requests.
  • Generally discovers fewer subdomains than Subfinder or Amass.
  • Brute-force mode can generate network traffic that may be detected.

When to Use

Use Sublist3r when you need to:

  • Perform passive subdomain enumeration.
  • Cross-check results from other enumeration tools.
  • Expand reconnaissance coverage using multiple search engines.
  • Supplement findings from Subfinder or Amass.
  • Discover publicly available subdomains before active scanning.

Official Resources

Developer: Aboul3la

Official GitHub: https://github.com/aboul3la/Sublist3r

CLI Reference:

1. Basic Subdomain Enumeration (d, -domain)

What is it?

The -d (or --domain) flag is used to specify the target domain for passive subdomain enumeration.

Sublist3r searches multiple public sources such as search engines, certificate transparency logs, DNS databases, and OSINT services to discover publicly available subdomains associated with the target domain.

Why is it Used?

  • Discover publicly available subdomains.
  • Expand the target attack surface.
  • Identify production, API, development, and support servers.
  • Gather reconnaissance information before security testing.
  • Perform passive subdomain enumeration without directly scanning the target.

Syntax

sublist3r -d <domain>

or

sublist3r --domain <domain>

How it Works

  1. Accepts the target domain.
  2. Queries multiple passive data sources.
  3. Collects discovered subdomains.
  4. Removes duplicate entries.
  5. Displays the final list of unique subdomains.

Example

sublist3r -d instagram.com

Output:

[-] Enumerating subdomains now for instagram.com
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[!] DNSDumpster module failed: Could not find CSRF token on DNSDumpster page
[!] Error: Virustotal probably now is blocking our requests
[-] Total Unique Subdomains Found: 20
www.instagram.com
about.instagram.com
accountscenter.instagram.com
aistudio.instagram.com
api.instagram.com
applink.instagram.com
bigzipfiles.instagram.com
business.instagram.com
call.instagram.com
creators.instagram.com
familycenter.instagram.com
graph.instagram.com
help.instagram.com
i.instagram.com
l.instagram.com
lookaside.instagram.com
privacycenter.instagram.com
secure.instagram.com
dyi.www.instagram.com
www-fallback.instagram.com

Advantages

  • Easy to use with a single command.
  • Uses multiple passive OSINT sources.
  • Does not directly interact with the target server.
  • Automatically removes duplicate subdomains.
  • Suitable for reconnaissance and attack surface discovery.

Disadvantages

  • Only discovers publicly known subdomains.
  • Results depend on the availability of passive sources.
  • Some search engines or services may block requests.
  • Older modules may fail if third-party websites change.
  • Cannot discover internal or private subdomains.

2. Brute Force Enumeration (b, -bruteforce)

What is it?

The -b (or --bruteforce) flag enables Sublist3r's built-in Subbrute module.

In addition to passive enumeration, Sublist3r performs DNS brute-force enumeration by generating common subdomain names from a wordlist and checking whether they exist.

Why is it Used?

  • Discover subdomains not found by passive sources.
  • Expand the target attack surface.
  • Find hidden or less common subdomains.
  • Combine passive and brute-force enumeration.
  • Improve reconnaissance coverage.

Syntax

sublist3r -d <domain> -b

or

sublist3r --domain <domain> --bruteforce

How it Works

  1. Performs normal passive subdomain enumeration.
  2. Starts the Subbrute module.
  3. Generates common subdomain names using a built-in wordlist.
  4. Resolves each generated subdomain using DNS.
  5. Displays all unique subdomains discovered from both passive sources and brute force.

Example

sublist3r -d instagram.com -b

Output:

[-] Enumerating subdomains now for instagram.com
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[!] DNSDumpster module failed: Could not find CSRF token on DNSDumpster page
[!] Error: Virustotal probably now is blocking our requests
[-] Starting bruteforce module now using subbrute..
[-] Total Unique Subdomains Found: 55
instagram.com
www.instagram.com
about.instagram.com
accountscenter.instagram.com
admin.instagram.com
airwave.instagram.com
aistudio.instagram.com
api.instagram.com
applink.instagram.com
approval.instagram.com
auth.instagram.com
autodiscover.instagram.com
badges.instagram.com
bigzipfiles.instagram.com
blog.instagram.com
brand.instagram.com
business.instagram.com
c0.instagram.com
instagram.c10r.instagram.com
z-p42-instagram.c10r.instagram.com
call.instagram.com
checkout.instagram.com
community.instagram.com
creators.instagram.com
developers.instagram.com
engineering.instagram.com
familycenter.instagram.com
gateway.instagram.com
geo.instagram.com
graph.instagram.com
help.instagram.com
i.instagram.com
imagine.instagram.com
intern.instagram.com
l.instagram.com
logger.instagram.com
lookaside.instagram.com
m.instagram.com
maps.instagram.com
parents.instagram.com
payments.instagram.com
platform.instagram.com
pm.instagram.com
preprod.instagram.com
privacy.instagram.com
privacycenter.instagram.com
safety.instagram.com
secure.instagram.com
survey.instagram.com
upload.instagram.com
weblink.instagram.com
wellbeing.instagram.com
dyi.www.instagram.com
www-fallback.instagram.com
xweb.instagram.com

Advantages

  • Discovers additional subdomains beyond passive enumeration.
  • Combines passive and active discovery techniques.
  • Helps identify hidden or unindexed subdomains.
  • Improves reconnaissance coverage.
  • Automatically merges and removes duplicate results.

Disadvantages

  • Slower than passive enumeration alone.
  • Performs DNS queries, making it no longer a purely passive scan.
  • Results depend on the built-in wordlist.
  • May still miss uncommon or randomly named subdomains.

3. Port Scanning (p, -ports)

What is it?

The -p (or --ports) flag is used to scan discovered subdomains for specified TCP ports after subdomain enumeration is completed.

Instead of only listing subdomains, Sublist3r checks whether the specified ports are open on each discovered host.

Why is it Used?

  • Identify open TCP ports on discovered subdomains.
  • Verify whether common services are accessible.
  • Combine subdomain enumeration and basic port scanning.
  • Quickly identify active web services.
  • Reduce the need for a separate basic port scan.

Syntax

sublist3r -d <domain> -p <port1>,<port2>,<port3>

or

sublist3r --domain <domain> --ports <port1>,<port2>,<port3>

How it Works

  1. Performs normal subdomain enumeration.
  2. Collects all unique subdomains.
  3. Scans each discovered subdomain for the specified TCP ports.
  4. Reports the ports that are open on each host.

Example

sublist3r -d instagram.com -p 80,443,8080

Output:

[-] Enumerating subdomains now for instagram.com
...
[-] Total Unique Subdomains Found: 20
[-] Start port scan now for the following ports: 80,443,8080
lookaside.instagram.com - Found open ports: 80, 443
call.instagram.com - Found open ports: 80, 443
business.instagram.com - Found open ports: 80, 443
applink.instagram.com - Found open ports: 80, 443
www.instagram.com - Found open ports: 80, 443
about.instagram.com - Found open ports: 80, 443
bigzipfiles.instagram.com - Found open ports: 80, 443
l.instagram.com - Found open ports: 80, 443
api.instagram.com - Found open ports: 80, 443
accountscenter.instagram.com - Found open ports: 80, 443
aistudio.instagram.com - Found open ports: 80, 443
privacycenter.instagram.com - Found open ports: 80, 443
graph.instagram.com - Found open ports: 80, 443
help.instagram.com - Found open ports: 80, 443
www-fallback.instagram.com - Found open ports: 80, 443
i.instagram.com - Found open ports: 80, 443
secure.instagram.com - Found open ports: 80, 443
familycenter.instagram.com - Found open ports: 80, 443
dyi.www.instagram.com - Found open ports: 80, 443
creators.instagram.com - Found open ports: 80, 443

Advantages

  • Combines subdomain enumeration and basic port scanning in a single command.
  • Quickly identifies open TCP ports on discovered subdomains.
  • Helps locate accessible services such as HTTP and HTTPS.
  • Supports scanning multiple ports simultaneously.
  • Useful for quick reconnaissance.

Disadvantages

  • Performs only basic TCP port scanning.
  • Not as powerful as dedicated port scanners like Nmap or Naabu.
  • Requires the user to specify the ports to scan.
  • Scanning many ports or many subdomains increases execution time.

4. Verbose Output (v, -verbose)

What is it?

The -v (or --verbose) flag enables verbose mode, allowing Sublist3r to display discovered subdomains in real time as they are found by each search engine or passive source.

Instead of waiting until the scan finishes, the results are displayed immediately during the enumeration process.

Why is it Used?

  • Monitor subdomain discovery in real time.
  • Identify which search engine or passive source discovered each subdomain.
  • Observe the progress of the enumeration process.
  • Troubleshoot passive source behavior.
  • Useful for debugging and analysis.

Syntax

sublist3r -d <domain> -v

or

sublist3r --domain <domain> --verbose

How it Works

  1. Starts normal passive subdomain enumeration.
  2. Enables verbose mode.
  3. Displays each discovered subdomain immediately along with the source that found it.
  4. Continues until all passive sources finish.
  5. Prints the final list of unique subdomains.

Example

sublist3r -d instagram.com -v

Output:

[-] Enumerating subdomains now for instagram.com
[-] verbosity is enabled, will show the subdomains results in realtime
[-] Searching now in Baidu..
[-] Searching now in Yahoo..
[-] Searching now in Google..
[-] Searching now in Bing..
[-] Searching now in Ask..
[-] Searching now in Netcraft..
[-] Searching now in DNSdumpster..
[-] Searching now in Virustotal..
[-] Searching now in ThreatCrowd..
[-] Searching now in SSL Certificates..
[-] Searching now in PassiveDNS..
[!] DNSDumpster module failed: Could not find CSRF token on DNSDumpster page
[!] Error: Virustotal probably now is blocking our requests
Netcraft: www.instagram.com
Netcraft: l.instagram.com
Netcraft: accountscenter.instagram.com
Netcraft: help.instagram.com
Netcraft: privacycenter.instagram.com
Netcraft: aistudio.instagram.com
Netcraft: about.instagram.com
Netcraft: familycenter.instagram.com
Netcraft: secure.instagram.com
Netcraft: creators.instagram.com
Netcraft: www-fallback.instagram.com
Netcraft: business.instagram.com
Netcraft: i.instagram.com
Netcraft: graph.instagram.com
Netcraft: lookaside.instagram.com
Netcraft: applink.instagram.com
Netcraft: api.instagram.com
Netcraft: dyi.www.instagram.com
Netcraft: call.instagram.com
Netcraft: bigzipfiles.instagram.com
[-] Total Unique Subdomains Found: 20
www.instagram.com
about.instagram.com
accountscenter.instagram.com
aistudio.instagram.com
api.instagram.com
applink.instagram.com
bigzipfiles.instagram.com
business.instagram.com
call.instagram.com
creators.instagram.com
familycenter.instagram.com
graph.instagram.com
help.instagram.com
i.instagram.com
l.instagram.com
lookaside.instagram.com
privacycenter.instagram.com
secure.instagram.com
dyi.www.instagram.com
www-fallback.instagram.com

Advantages

  • Displays discovered subdomains in real time.
  • Shows which passive source found each subdomain.
  • Helps monitor scan progress.
  • Useful for debugging and troubleshooting.
  • Makes it easier to analyze source effectiveness.

Disadvantages

  • Produces more terminal output.
  • Can be harder to read during large scans.
  • Does not improve subdomain discovery results.
  • Primarily intended for monitoring and debugging.

5. Search Engine Selection (e, -engines)

What is it?

The -e (or --engines) flag is used to specify one or more search engines (passive sources) that Sublist3r should use for subdomain enumeration.

Instead of querying all available sources, Sublist3r performs the enumeration using only the selected search engine(s).

Why is it Used?

  • Use only specific passive sources.
  • Reduce unnecessary requests.
  • Speed up enumeration.
  • Test the effectiveness of individual search engines.
  • Troubleshoot issues with particular sources.

Syntax

sublist3r -d <domain> -e <engine>

or

sublist3r -d <domain> -e <engine1>,<engine2>,<engine3>

Supported Search Engines

google
yahoo
bing
baidu
ask
netcraft
dnsdumpster
virustotal
threatcrowd
ssl
passivedns

How it Works

  1. Accepts the target domain.
  2. Uses only the specified search engine(s).
  3. Collects subdomains from those sources.
  4. Removes duplicate entries.
  5. Displays the final list of unique subdomains.

Example

sublist3r -d instagram.com -e netcraft

Output:

[-] Enumerating subdomains now for instagram.com
[-] Searching now in Netcraft..
[-] Total Unique Subdomains Found: 20
www.instagram.com
about.instagram.com
accountscenter.instagram.com
aistudio.instagram.com
api.instagram.com
applink.instagram.com
bigzipfiles.instagram.com
business.instagram.com
call.instagram.com
creators.instagram.com
familycenter.instagram.com
graph.instagram.com
help.instagram.com
i.instagram.com
l.instagram.com
lookaside.instagram.com
privacycenter.instagram.com
secure.instagram.com
dyi.www.instagram.com
www-fallback.instagram.com

Advantages

  • Allows enumeration using specific passive sources.
  • Reduces unnecessary network requests.
  • Can speed up the enumeration process.
  • Useful for testing and comparing search engines.
  • Helps avoid unreliable or blocked sources.

Disadvantages

  • Using fewer search engines may reduce subdomain coverage.
  • Results depend on the selected source's database.
  • Some search engines may block automated requests or become unavailable.

6. Save Output to File (o, -output)

What is it?

The -o (or --output) flag is used to save all discovered subdomains to a text file.

Instead of only displaying the results in the terminal, Sublist3r writes the discovered subdomains to the specified output file.

Why is it Used?

  • Save enumeration results for later use.
  • Store discovered subdomains in a text file.
  • Share results with other tools.
  • Simplify documentation and reporting.
  • Avoid rerunning the enumeration.

Syntax

sublist3r -d <domain> -o <filename>.txt

or

sublist3r --domain <domain> --output <filename>.txt

How it Works

  1. Performs normal subdomain enumeration.
  2. Collects all unique subdomains.
  3. Saves the discovered subdomains to the specified text file.
  4. Displays the results in the terminal.

Example

sublist3r -d instagram.com -o output.txt

Output:

[-] Enumerating subdomains now for instagram.com
...
[-] Saving results to file: output.txt
[-] Total Unique Subdomains Found: 20
www.instagram.com
about.instagram.com
accountscenter.instagram.com
aistudio.instagram.com
api.instagram.com
applink.instagram.com
bigzipfiles.instagram.com
business.instagram.com
call.instagram.com
creators.instagram.com
familycenter.instagram.com
graph.instagram.com
help.instagram.com
i.instagram.com
l.instagram.com
lookaside.instagram.com
privacycenter.instagram.com
secure.instagram.com
dyi.www.instagram.com
www-fallback.instagram.com

Contents of output.txt:

www.instagram.com
about.instagram.com
accountscenter.instagram.com
aistudio.instagram.com
api.instagram.com
applink.instagram.com
bigzipfiles.instagram.com
business.instagram.com
call.instagram.com
creators.instagram.com
familycenter.instagram.com
graph.instagram.com
help.instagram.com
i.instagram.com
l.instagram.com
lookaside.instagram.com
privacycenter.instagram.com
secure.instagram.com
dyi.www.instagram.com
www-fallback.instagram.com

Advantages

  • Saves enumeration results for future reference.
  • Produces a simple text file that is easy to read.
  • Useful for documentation and reporting.
  • Allows results to be reused by other tools.
  • Eliminates the need to manually copy terminal output.

Disadvantages

  • Supports only plain text output.
  • Existing files with the same name may be overwritten.
  • Does not include additional metadata such as the search engine that discovered each subdomain.

7. Number of Threads (t, -threads)

What is it?

The -t (or --threads) flag is used to specify the number of concurrent threads used by the Subbrute brute-force module.

It controls how many DNS brute-force requests are performed simultaneously during brute-force enumeration.

Note: This option only works when the -b (Brute Force) option is enabled. It has no effect during normal passive enumeration

Why is it Used?

  • Increase brute-force enumeration speed.
  • Control the number of concurrent DNS requests.
  • Optimize performance based on system resources.
  • Balance scanning speed and resource usage.
  • Reduce brute-force execution time.

Syntax

sublist3r -d <domain> -b -t <threads>

or

sublist3r --domain <domain> --bruteforce --threads <threads>

Default Value

30 Threads

Supported Range

1 or any positive integer

There is no fixed maximum limit enforced by Sublist3r. However, extremely large thread values are generally not recommended because they increase CPU, memory, and network usage without significantly improving results.

How it Works

  1. Starts normal passive enumeration.
  2. Enables the Subbrute brute-force module.
  3. Creates the specified number of worker threads.
  4. Each thread performs DNS brute-force requests simultaneously.
  5. Combines all discovered subdomains into the final result.

Example

sublist3r -d instagram.com -b -t 20

This command:

  • Performs passive subdomain enumeration.
  • Enables brute-force enumeration.
  • Uses 20 concurrent threads for DNS brute-force.

Does Increasing Threads Find More Subdomains?

No.

Increasing the thread count does not increase the number of discovered subdomains.

It only affects how quickly the brute-force process completes.

Example:

5 Threads
↓
55 Subdomains
Time: 60 Seconds
20 Threads
↓
55 Subdomains
Time: 20 Seconds

The discovered subdomains remain the same; only the execution time changes.

Threads Recommendation

1–10 Slower but uses fewer system resources.

30 (Default) Recommended for most users.

50–100 Faster on powerful systems and stable networks. Above 1

100 Usually provides little additional benefit and may increase CPU, memory, and DNS load.

Advantages

  • Speeds up brute-force enumeration.
  • Reduces overall execution time.
  • Allows users to optimize performance based on available resources.
  • Improves efficiency when scanning large wordlists.

Disadvantages

  • Works only with the b (Brute Force) option.
  • Higher thread counts consume more CPU, memory, and network resources.
  • Very high values may overload DNS resolvers or slower systems.
  • Does not increase the number of discovered subdomains; it only affects scanning speed.

You can end your Medium article with something like this:

Conclusion

Sublist3r is a simple yet effective tool for passive subdomain enumeration. It gathers information from multiple public search engines and OSINT sources, with optional features such as brute-force enumeration, port scanning, and source selection to enhance reconnaissance. Although it is no longer as actively maintained as modern alternatives like Subfinder or Amass, it remains a valuable tool for learning subdomain enumeration concepts and performing basic reconnaissance. Understanding how each command-line option works allows security professionals and students to use Sublist3r more effectively during the information-gathering phase of a security assessment.