PAGES
← all tools
◆ Reconnaissance & OSINT

sublist3r

V1.0 open-source

Fast subdomains enumeration tool for penetration testers - aboul3la/Sublist3r

source ↗ rss ↗ What is a cyber toolchain?

Summary

Sublist3r is an open-source, free, command-line tool written in Python that enumerates the subdomains of a target domain using OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. sources such as Google, Bing, Yahoo, Baidu, Ask, Netcraft, VirusTotal, ThreatCrowd and DNSdumpster, with an optional bruteforce module (via subbrute) to turn up names passive sources miss. It's aimed at penetration testers and bug bounty hunters doing early-stage recon, run by cloning the repo and invoking it from the command line with flags for domain, port scanning, thread count, engine selection and output format. It sits in the passive-recon and subdomain-enumeration space, covering ground now split across several dedicated OSINT and DNS recon tools. The project dates to 2015 and has drawn 30 contributors, but there have been no commits in the past year, so treat it as stable rather than actively maintained.

Fast subdomains enumeration tool for penetration testers - aboul3la/Sublist3r

How sublist3r helps

Which subdomains does a target domain have that are visible to public search engines and OSINT sources?

queries Google, Yahoo, Bing, Baidu, Ask, Netcraft, VirusTotal, ThreatCrowd and DNSdumpster for the domain and merges their results into a single deduplicated subdomain list

Which subdomains exist but never show up in search-engine indexes?

runs the bundled bruteforce module against a wordlist, resolving each guess via DNS to surface names passive sources miss

Which of these discovered subdomains have something reachable listening on them?

takes the compiled subdomain list and scans each host for open ports, flagging which ones have live services

Which OSINT sources actually contributed to this domain's subdomain list, and can I narrow the search?

lets you select which search engines and sources run, so you can see results source-by-source rather than only as a merged list

How do I get this subdomain list into another recon tool or report?

writes the enumerated subdomains to an output file for feeding into subsequent scanning or reporting steps

all 3 features, with the evidence for each →

Languages

Not documented

Features

3 capabilities across 2 capability groups · 1 backed by code, an API document or a real run

Built from sublist3r's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • sublist3r covers 2 of the 13 network discovery and scanning capabilities we track.

What sublist3r offers you

  • Command-line interface1
Subdomain enumeration 2 features Network discovery and scanning since 2016
Subdomain enumeration verified Discovers subdomains for a target domain by querying multiple search engines and optionally bruteforcing, with controls for threads, verbosity, output file, and color suppression. 9 other sources · first seen Jul 2016

Shared capability: Subdomain enumeration

Also counts toward: Command-line interface

docs

  • Enumerates subdomains of a target domain using OSINT search engines and optional bruteforce.

we ran it

  • Sublist3r requires a domain via -d and supports optional bruteforce (-b), port scanning (-p), verbosity (-v), thread control (-t), engine selection (-e), file output (-o), and color suppression (-n). Aug 2026 · the full run

example 7 total

  • Scan discovered subdomains on specific TCP ports 80 and 443 using the new port scan feature. sublist3r -d example.com -p 80,443 V1.0 · Jul 2016 · source
  • Enable bruteforce module python sublist3r.py -b -d example.com
  • Find subdomains with open ports python sublist3r.py -d example.com -p 80,443
  • Use specific search engines python sublist3r.py -e google,yahoo,virustotal -d example.com
  • Enumerate subdomains of a domain python sublist3r.py -d example.com
  • Show results in realtime python sublist3r.py -v -d example.com
Subdomain enumeration sources shipped Expands subdomain discovery capabilities by adding VirusTotal, SSL Certs, and PassiveDNS as sources. 1 release · first seen Jul 2016

Shared capability: Subdomain enumeration

release

  • Added Virustotal, SSL Certs, and PassiveDNS as new OSINT enumeration sources for subdomain discovery. V1.0 · Jul 2016 · source · release history
Attack surface inventory 1 feature Network discovery and scanning since 2016
Port scanning shipped Scans discovered subdomains for specific TCP ports. 1 release · first seen Jul 2016

Shared capability: Attack surface inventory

release

  • Added -p flag to filter and scan found subdomains against specific TCP ports using the new Port Scan Feature. V1.0 · Jul 2016 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for sublist3r, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail sublist3r puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

1 entry

  1. July 20161

    1 entry

    1. V1.0 Jul 5, 2016 · release notes

      Sublist3r v1.0 adds Virustotal, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Certs, PassiveDNS sources and -p port scanning

      └──▷ GET THIS VERSION 
      $ git clone --branch V1.0 https://github.com/aboul3la/Sublist3r.git
# already have the repo? check out this version:
$ git checkout V1.0
      └──▷ USE IT
      Scan discovered subdomains on specific TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports 80 and 443 using the new port scan feature.
      shell 
      sublist3r -d example.com -p 80,443
      • Added Virustotal, SSL Certs, and PassiveDNS as new OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. enumeration sources for subdomain discovery.
      • Added -p flag to filter and scan found subdomains against specific TCP ports using the new Port Scan Feature.

      2 details in Everything

    Project health

    Issue, contributor and maintainer activity in aboul3la/Sublist3r, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 160 of 231 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 160
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 11,042
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback