.\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
.TH FINDOMAIN "1" "July 2025" "findomain 10.0.1" "User Commands"
.SH NAME
findomain \- manual page for findomain 10.0.1
.SH SYNOPSIS
.B findomain
[\fI\,OPTIONS\/\fR]
.SH DESCRIPTION
The fastest and cross\-platform subdomain enumerator, do not waste your time.
.SH OPTIONS
.HP
\fB\-t\fR, \fB\-\-target\fR <TARGET>
.IP
Target host
.HP
\fB\-r\fR, \fB\-\-resolved\fR
.IP
Show/write only resolved subdomains
.HP
\fB\-i\fR, \fB\-\-ip\fR
.IP
Show/write the ip address of resolved subdomains
.HP
\fB\-f\fR, \fB\-\-file\fR <FILES>
.IP
Use a list of subdomains writen in a file as input
.HP
\fB\-o\fR, \fB\-\-output\fR
.IP
Write to an automatically generated output file. The name of the output file is generated using the format: target.txt. If you want a custom output file name, use the \fB\-u\fR/\-\-unique\-output option
.HP
\fB\-u\fR, \fB\-\-unique\-output\fR <UNIQUE_OUTPUT>
.IP
Write all the results for a target or a list of targets to a specified filename
.HP
\fB\-m\fR, \fB\-\-monitoring\-flag\fR
.IP
Activate Findomain monitoring mode
.HP
\fB\-\-postgres\-user\fR <POSTGRES_USER>
.IP
Postgresql username
.HP
\fB\-\-postgres\-password\fR <POSTGRES_PASSWORD>
.IP
Postgresql password
.HP
\fB\-\-postgres\-host\fR <POSTGRES_HOST>
.IP
Postgresql host
.HP
\fB\-\-postgres\-port\fR <POSTGRES_PORT>
.IP
Postgresql port
.HP
\fB\-\-postgres\-database\fR <POSTGRES_DATABASE>
.IP
Postgresql database
.HP
\fB\-q\fR, \fB\-\-quiet\fR
.IP
Remove informative messages but show fatal errors or subdomains not found message
.HP
\fB\-\-query\-database\fR
.IP
Query the findomain database to search subdomains that have already been discovered
.HP
\fB\-\-import\-subdomains\fR <IMPORT_SUBDOMAINS>
.IP
Import subdomains from one or multiple files. Subdomains need to be one per line in the file to import
.HP
\fB\-\-enable\-dot\fR
.IP
Enable DNS over TLS for resolving subdomains IPs
.HP
\fB\-\-ipv6\-only\fR
.IP
Perform a IPv6 lookup only
.HP
\fB\-\-threads\fR <THREADS>
.IP
Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Deprecated option, use \fB\-\-lighweight\-threads\fR instead. This would be removed in the future
.HP
\fB\-\-lightweight\-threads\fR <LIGHTWEIGHT_THREADS>
.IP
Number of threads to use for lightweight tasks such as IP discovery and HTTP checks. Default is 50
.HP
\fB\-\-screenshots\-threads\fR <SCREENSHOTS_THREADS>
.IP
Number of threads to use to use for taking screenshots. Default is 10
.HP
\fB\-\-parallel\-ip\-ports\-scan\fR <PARALLEL_IP_PORTS_SCAN>
.IP
Number of IPs that will be port\-scanned at the same time. Default is 10
.HP
\fB\-\-tcp\-connect\-threads\fR <TCP_CONNECT_THREADS>
.IP
Number of threads to use for TCP connections \- It's the equivalent of Nmap's \fB\-\-min\-rate\fR. Default is 500
.HP
\fB\-\-resolvers\fR <CUSTOM_RESOLVERS>
.IP
Path to a file (or files) containing a list of DNS IP address. If no specified then Google, Cloudflare and Quad9 DNS servers are used
.HP
\fB\-\-aempty\fR
.IP
Send alert to webhooks still when no new subdomains have been found
.HP
\fB\-x\fR, \fB\-\-as\-resolver\fR
.IP
Use Findomain as resolver for a list of domains in a file
.HP
\fB\-w\fR, \fB\-\-wordlist\fR <WORDLISTS>
.IP
Wordlist file to use in the bruteforce process. Using it option automatically enables bruteforce mode
.HP
\fB\-\-no\-wildcards\fR
.IP
Disable wilcard detection when resolving subdomains
.HP
\fB\-\-filter\fR <STRING_FILTER>
.IP
Filter subdomains containing specifics strings
.HP
\fB\-\-exclude\fR <STRING_EXCLUDE>
.IP
Exclude subdomains containing specifics strings
.HP
\fB\-\-exclude\-sources\fR <EXCLUDE_SOURCES>
.IP
Exclude sources from searching subdomains in [possible values: certspotter, crtsh, sublist3r, facebook, spyse, threatcrowd, virustotalapikey, anubis, urlscan, securitytrails, threatminer, c99, bufferover_free, bufferover_paid]
.HP
\fB\-\-http\-status\fR
.IP
Check the HTTP status of subdomains
.HP
\fB\-c\fR, \fB\-\-config\fR <CONFIG_FILE>
.IP
Use a configuration file. The default configuration file is findomain and the format can be toml, json, hjson, ini or yml
.HP
\fB\-\-rate\-limit\fR <RATE_LIMIT>
.IP
Set the rate limit in seconds for each target during enumeration
.HP
\fB\-\-pscan\fR
.IP
Enable port scanner
.HP
\fB\-\-iport\fR <INITIAL_PORT>
.IP
Initial port to scan. Default 0
.HP
\fB\-\-lport\fR <LAST_PORT>
.IP
Last port to scan. Default 1000
.HP
\fB\-v\fR, \fB\-\-verbose\fR
.IP
Enable verbose mode (useful to debug problems)
.HP
\fB\-\-mtimeout\fR
.IP
Allow Findomain to insert data in the database when the webhook returns a timeout error
.HP
\fB\-\-no\-monitor\fR
.IP
Disable monitoring mode while saving data to database
.HP
\fB\-s\fR, \fB\-\-screenshots\fR <SCREENSHOTS_PATH>
.IP
Path to save the screenshots of the HTTP(S) website for subdomains with active ones
.HP
\fB\-\-sandbox\fR
.IP
Enable Chrome/Chromium sandbox. It is disabled by default because a big number of users run the tool using the root user by default. Make sure you are not running the program as root user before using this option
.HP
\fB\-j\fR, \fB\-\-jobname\fR <JOBNAME>
.IP
Use an database identifier for jobs. It is useful when you want to relate different targets into a same job name. To extract the data by job name identifier, use the query\-jobname option
.HP
\fB\-\-query\-jobname\fR
.IP
Extract all the subdomains from the database where the job name is the specified using the jobname option
.HP
\fB\-\-http\-timeout\fR <HTTP_TIMEOUT>
.IP
Value in seconds for the HTTP Status check of subdomains. Default 5
.HP
\fB\-\-tcp\-connect\-timeout\fR <TCP_CONNECT_TIMEOUT>
.IP
Value in milliseconds to wait for the TCP connection (ip:port) in the ports scanning function. Default 2000
.HP
\fB\-\-stdin\fR
.IP
Read from stdin instead of files or aguments
.HP
\fB\-\-ua\fR <USER_AGENTS_FILE>
.IP
Path to file containing user agents strings
.HP
\fB\-\-randomize\fR
.IP
Enable randomization when reading targets from files
.HP
\fB\-\-no\-resolve\fR
.IP
Disable pre\-screenshotting jobs (http check and ip discover) when used as resolver to take screenshots
.HP
\fB\-\-external\-subdomains\fR
.IP
Get external subdomains with amass and subfinder
.HP
\fB\-\-validate\fR
.IP
Validate all the subdomains from the specified file
.HP
\fB\-\-resolver\-timeout\fR <RESOLVER_TIMEOUT>
.IP
Timeout in seconds for the resolver. Default 1
.HP
\fB\-\-http\-retries\fR <HTTP_RETRIES>
.IP
Number of retries for the HTTP Status check of subdomains. Default 1
.HP
\fB\-\-double\-dns\-check\fR
.IP
Enable double DNS check. This means that the subdomains that report an IP address are checked again using a list of trustable resolvers to avoid false\-positives. Only applies when using custom resolvers
.HP
\fB\-n\fR, \fB\-\-no\-discover\fR
.IP
Prevent findomain from searching subdomains itself. Useful when you are importing subdomains from other tools
.HP
\fB\-\-max\-http\-redirects\fR <MAX_HTTP_REDIRECTS>
.IP
Maximum number of HTTP redirects to follow. Default 0
.HP
\fB\-\-reset\-database\fR
.IP
Reset the database. It will delete all the data from the database
.HP
\fB\-h\fR, \fB\-\-help\fR
.IP
Print help
.HP
\fB\-V\fR, \fB\-\-version\fR
.IP
Print version
.SH "SEE ALSO"
The full documentation for
.B findomain
is maintained as a Texinfo manual.  If the
.B info
and
.B findomain
programs are properly installed at your site, the command
.IP
.B info findomain
.PP
should give you access to the complete manual.