Ultimate Sublist3r Cheat Sheet

Fast subdomain enumeration tool. Discover subdomains using OSINT and brute force.

Jump To Section

• Basic Usage
• Search Engines
• Brute Force Mode
• Output & Ports
• Advanced Features
• Tool Integration

1. Basic Usage

Enumerate subdomains using multiple search engines and passive sources.

Single Domain

sublist3r -d example.com

Verbose Output

sublist3r -v -d example.com

Multiple Domains

sublist3r -d example.com,example.org,example.net

Save to File

sublist3r -d example.com -o subdomains.txt

Basic Flags

• -d <domain> : Target domain
• -o <file> : Output file
• -v : Verbose mode
• -h : Help menu

Quick Examples

• sublist3r -d tesla.com
• sublist3r -v -d google.com
• sublist3r -d apple.com -o apple-subs.txt
• sublist3r -d amazon.com,netflix.com

2. Search Engines

All Engines (Default)

sublist3r -d example.com

Specific Engine

sublist3r -e google -d example.com

Multiple Engines

sublist3r -e google,yahoo,bing -d example.com

All Available Engines

sublist3r -e google,yahoo,bing,baidu,ask,netcraft,dnsdumpster,virustotal,threatcrowd,ssl,passivedns -d example.com

Engine	Description	Type
google	Google search	Search Engine
yahoo	Yahoo search	Search Engine
bing	Bing search	Search Engine
baidu	Baidu search	Search Engine
ask	Ask.com search	Search Engine
netcraft	Netcraft DNS data	DNS Database
dnsdumpster	DNSDumpster	DNS Database
virustotal	VirusTotal DNS	Threat Intel
threatcrowd	ThreatCrowd	Threat Intel
ssl	SSL certificates	Certificate Logs
passivedns	Passive DNS	DNS Database

Pro Tip: Engine Selection
Use -e google,ssl,netcraft for fastest results with good coverage. Add virustotal and threatcrowd for threat intelligence data. Avoid using all engines if speed is critical.

3. Brute Force Mode

Enable Brute Force

sublist3r -b -d example.com

Brute Force with Custom Wordlist

sublist3r -b -w /path/to/wordlist.txt -d example.com

Brute Force with Specific Engines

sublist3r -b -e google -w subdomains.txt -d example.com

Full Enumeration (Passive + Brute Force)

sublist3r -b -e google,yahoo,bing -w /usr/share/wordlists/subdomains-top1million-5000.txt -d example.com

Brute Force Options

• -b : Enable brute force
• -w <file> : Custom wordlist
• -t <threads> : Thread count
• -p <ports> : Port scan

Popular Wordlists

• subdomains-top1million-5000.txt
• subdomains-top1million-20000.txt
• dns-jhaddix.txt
• SecLists/Discovery/DNS/

Warning:

Brute force mode can be slow and resource-intensive. Use -t to control threads. Default wordlist (if no -w specified) is the built-in subbrute names list with approximately 100 common subdomain prefixes.

4. Output & Port Scanning

Save Results

sublist3r -d example.com -o output.txt

Enable Port Scanning

sublist3r -d example.com -p 80,443

Full Port Scan

sublist3r -d example.com -p 80,443,8080,8443,21,22,25,53,3306,3389

Verbose with Port Scan

sublist3r -v -d example.com -p 80,443 -o full-results.txt

Output Processing

• sort -u : Deduplicate results
• wc -l : Count subdomains
• grep -v : Filter results
• tee : Save and display

Common Ports

• 80,443 : Web services
• 21,22 : FTP and SSH
• 25,53 : Mail and DNS
• 3306,3389 : MySQL and RDP

5. Advanced Features

Python Module Import

import sublist3r subdomains = sublist3r.main('example.com', 40, 'subdomains.txt', ports=[80,443], silent=True, verbose=False, enable_bruteforce=False, engines=None)

Thread Control

sublist3r -d example.com -t 50

Silent Mode

sublist3r -d example.com --silent

Combine with Other Tools

sublist3r -d example.com | sort -u | httprobe

Flag	Description	Default
-t <threads>	Number of threads	40
-p <ports>	Port scan discovered hosts	Off
--silent	Suppress banner	Off
--no-color	Disable colored output	Off
-v	Verbose output	Off

6. Tool Integration

Complete Recon Pipeline

sublist3r -d example.com -o subs.txt && cat subs.txt | httprobe > live.txt

With Nmap

sublist3r -d example.com | sort -u | xargs -I{} nmap -sV -sC {}

With Nuclei

sublist3r -d example.com | httprobe | nuclei -t ~/nuclei-templates/

With Aquatone

sublist3r -d example.com | httprobe | aquatone -out aquatone-report

Multi-Tool Comparison

cat <(sublist3r -d example.com) <(assetfinder example.com) <(subfinder -d example.com) | sort -u > all-subs.txt

Pro Tip: Combined Enumeration Script

Create a comprehensive subdomain enumeration script:
#!/bin/bash
DOMAIN=$1
sublist3r -d $DOMAIN -o /tmp/sublist3r.txt
assetfinder --subs-only $DOMAIN > /tmp/assetfinder.txt
subfinder -d $DOMAIN -o /tmp/subfinder.txt
cat /tmp/*.txt | sort -u > final-subs.txt
cat final-subs.txt | httprobe > live-subs.txt

⇧