subfinder_enum
Enumerate subdomains of a target domain by querying multiple passive sources like certificate transparency logs, DNS datasets, and APIs, avoiding direct requests to the target.
Instructions
Enumerate subdomains passively using Subfinder.
Queries multiple passive sources (certificate transparency logs, DNS datasets, APIs) to discover subdomains without directly probing the target.
Args: domain: Target domain (e.g. "example.com"). sources: Optional list of specific sources to query (e.g. ["crtsh", "hackertarget", "censys"]). Leave empty to use all configured sources. timeout: Override default timeout in seconds.
Returns: List of discovered subdomains with metadata.
Note: - Passive enumeration only — does not send requests to the target domain. - Some sources require API keys configured in ~/.config/subfinder/config.yaml. - Target domain must match an entry in tengu.toml [targets].allowed_hosts.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | ||
| sources | No | ||
| timeout | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||