Find Subdomains

Parameters

NameTypeDescriptionValue
tool_idIntegerThe id of this tool20
targetStringThe domain name that will be searched for subdomains
web_detailsStringExtract also web server details for each subdomain (Server Type, Operating System, Technlogy, Web Platform, Page Title). Turn this option off for faster results- on (default)
- off
subdom_detailsStringShow IP information (netname, country)- on
- off (default)
Search methods
do_zone_transferStringDNS records (NS, MX, TXT, AXFR)- on (default)
- off
do_dns_enumerationStringDNS enumeration- on (default)
- off
do_ctr_searchStringCertificate Transparency Logs- on (default)
- off
do_ext_searchStringSubdomains from external APIs- on (default)
- off
do_bing_searchStringBing search- on (default)
- off
do_google_searchStringGoogle search- on (default)
- off
do_website_searchStringExtract from HTML links- on (default)
- off
do_ssl_searchStringExtract from SSL certificates- on (default)
- off
do_revdns_searchStringReverse DNS on target IP ranges- on (default)
- off
do_smart_searchStringSmart DNS search - Disabling this option will speed up the scan if the target has a large number of subdomains, but might reduce the number of results- on (default)
- off

Start scan examples

{
  "op": "start_scan",
  "tool_id": 20,
  "target": "bbc.com",
  "tool_params": {
    "web_details": "on"
  }
}
{
  "op": "start_scan_by_targetid",
  "tool_id": 20,
  "target_id": 7456213,
  "tool_params": {
    "web_details": "on",
    "do_smart_search": "off"
  }
}