sublist3r

Enumerate subdomains passively via OSINT sources with optional brute-force wordlists.

15|1|Updated Feb 12, 2026
One-click install
npx skills add https://github.com/AeonDave/malskill --skill sublist3r
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: sublist3r
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/recon/sublist3r
Command: npx skills add https://github.com/AeonDave/malskill --skill sublist3r

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the process of discovering subdomains for a given domain by leveraging various open-source intelligence (OSINT) sources, helping to map out the attack surface.

Core Features & Use Cases

  • Passive Enumeration: Gathers subdomains from search engines and threat intelligence platforms without direct interaction with the target's infrastructure.
  • Brute-Force Option: Can supplement passive results with a brute-force approach using a wordlist.
  • Use Case: When performing reconnaissance on a target organization, use this Skill to identify all publicly known subdomains associated with their main domain to understand their online presence.

Quick Start

Use the sublist3r skill to enumerate subdomains for 'example.com'.

Frequently Asked Questions about sublist3r

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains for a domain using OSINT sources?

Passive subdomain enumeration gathers subdomains from search engines and threat intelligence platforms like Google, Bing, VirusTotal, and ThreatCrowd without directly interacting with the target's infrastructure.

Can I use a wordlist to brute-force subdomain discovery?

Yes, you can supplement passive OSINT enumeration with a brute-force approach by providing a specified wordlist to discover additional subdomains not indexed by search engines.

Why use passive subdomain enumeration instead of active scanning?

Passive enumeration maps the attack surface by querying third-party OSINT sources, avoiding direct interaction with the target's infrastructure to maintain stealth during reconnaissance.

What is the best way to map the attack surface for threat intelligence?

Use this Skill to identify publicly known subdomains associated with a main domain, leveraging search engines and threat intelligence platforms to facilitate comprehensive domain mapping.

Does subdomain enumeration work with DNSDumpster and Baidu?

Yes, the Skill performs passive subdomain discovery by querying multiple OSINT sources including DNSDumpster, Baidu, Google, Bing, VirusTotal, and ThreatCrowd.