tools:
- name: subfinder_scan
description: Discover subdomains for a single domain using passive sources
run:
kind: shell
cmd: "subfinder -d {{domain}} {{options}}"
args:
domain:
type: string
description: "Target domain to enumerate subdomains for (e.g., example.com)"
required: true
options:
type: string
description: "Additional subfinder flags (space-separated). Examples: '-s crtsh,github -all -recursive -nW -t 25 -timeout 60 -o results.txt', '-es alienvault,zoomeyeapi', '-m sub.example.com,api.example.com', '-f dev.example.com', '-rl 50', '-rls github=30/m,virustotal=4/m', '-oI', '-proxy http://127.0.0.1:8080', '-r 1.1.1.1,8.8.8.8', '-rL resolvers.txt', '-ei', '-silent', '-v', '-nc', '-stats'"
required: false
default: ""
- name: subfinder_scan_list
description: Discover subdomains for a list of domains provided via file
run:
kind: shell
cmd: "subfinder -dL {{domain_list}} {{options}}"
args:
domain_list:
type: string
description: "Path to file containing domains (one per line) for enumeration"
required: true
options:
type: string
description: "Additional subfinder flags (space-separated). Common with -dL: '-oD output_dir' for per-domain outputs, plus any flags from subfinder_scan options."
required: false
default: ""
- name: subfinder_scan_json
description: Single domain subdomain discovery with JSONL output
run:
kind: shell
cmd: "subfinder -d {{domain}} -oJ {{options}}"
args:
domain:
type: string
description: "Target domain to enumerate subdomains for (e.g., example.com)"
required: true
options:
type: string
description: "Additional subfinder flags (space-separated). Examples: '-s crtsh,github -all -recursive -nW -t 25 -timeout 60 -o results.jsonl', '-cs' to include sources in JSON, plus the same flags supported by subfinder_scan."
required: false
default: ""
- name: subfinder_scan_list_json
description: Domain list subdomain discovery with JSONL output
run:
kind: shell
cmd: "subfinder -dL {{domain_list}} -oJ {{options}}"
args:
domain_list:
type: string
description: "Path to file containing domains (one per line) for enumeration"
required: true
options:
type: string
description: "Additional subfinder flags (space-separated). Common with -dL: '-oD output_dir' for per-domain outputs, '-cs' to include sources in JSON, plus any flags supported by subfinder_scan."
required: false
default: ""
