assetfinder is a small, single-purpose Go tool created by Tom Hudson (TomNomNom), a well-known contributor to the bug bounty tooling ecosystem. Its sole purpose is to find domains and subdomains potentially related to a given target using passive sources such as Certificate Transparency logs, the Wayback Machine, and other public datasets. It intentionally does one thing well rather than trying to be a full recon framework, which makes it a popular building block in shell pipelines alongside other TomNomNom tools like httprobe, waybackurls, and gf.
Installation
Assetfinder is written in Go and installed via go install, or is available pre-packaged on Kali.
# Kali/Debian
sudo apt update && sudo apt install assetfinder -y
# Via Go (any platform with Go installed)
go install github.com/tomnomnom/assetfinder@latest
# Ensure GOPATH/bin is in your PATH
export PATH=$PATH:$(go env GOPATH)/bin
Verify installation:
assetfinder --help
Syntax
assetfinder [--subs-only] DOMAIN
Assetfinder can also accept domains piped in via stdin.
Command-Line Options
| Flag | Description |
|---|---|
--subs-only | Only return subdomains of the given domain, excluding unrelated root domains found via passive sources |
(no flag) | Default mode also returns related root domains discovered alongside subdomains |
DOMAIN | The target domain, passed as a positional argument |
(stdin) | Domains can be piped in, one per line, instead of passed as an argument |
Note: Assetfinder is intentionally minimal and does not offer additional flags such as output formats, threading controls, or API key configuration — its simplicity is by design, and it relies entirely on being combined with other Unix tools via pipes.
Basic Usage
assetfinder example.com
Expected output:
www.example.com
mail.example.com
example.com
example.net
exampleinc.com
Practical Examples
Example 1 — Basic run (includes related root domains)
assetfinder example.com
www.example.com
mail.example.com
example.com
example-related.net
Example 2 — Subdomains only
assetfinder --subs-only example.com
www.example.com
mail.example.com
dev.example.com
Example 3 — Save output to a file
assetfinder --subs-only example.com > subs.txt
cat subs.txt
www.example.com
mail.example.com
dev.example.com
Example 4 — Piping a list of domains in via stdin
cat domains.txt
# example.com
# example.org
cat domains.txt | assetfinder --subs-only
www.example.com
mail.example.org
api.example.org
Example 5 — Chaining with httprobe to find live hosts
assetfinder --subs-only example.com | httprobe
https://www.example.com
https://mail.example.com
Example 6 — Deduplicating combined results from multiple tools
(assetfinder --subs-only example.com; subfinder -d example.com -silent) | sort -u
api.example.com
dev.example.com
mail.example.com
www.example.com
Example 7 — Chaining into nmap for a quick port scan of discovered hosts
assetfinder --subs-only example.com | while read -r sub; do
ip=$(dig +short "$sub" | tail -n1)
[ -n "$ip" ] && echo "$sub -> $ip"
done
www.example.com -> 93.184.216.34
mail.example.com -> 93.184.216.35
Common Use Cases
- Fast, no-configuration-needed passive subdomain discovery as one link in a larger Unix-pipe recon chain.
- Combining with
httprobe/httpxto quickly filter down to live web hosts. - Cross-validating results from other subdomain tools (Amass, Subfinder) by running Assetfinder in parallel and merging/deduplicating output.
- Lightweight recon in CI/CD-style automated bug bounty monitoring scripts where simplicity and speed matter more than exhaustive source coverage.
Automation with Bash
Merge Assetfinder with Subfinder and Amass for maximum subdomain coverage:
#!/bin/bash
# merged_recon.sh
DOMAIN=$1
{
assetfinder --subs-only "$DOMAIN"
subfinder -d "$DOMAIN" -silent
amass enum -passive -d "$DOMAIN"
} | sort -u > "${DOMAIN}_all_subs.txt"
echo "[+] Combined unique subdomains saved to ${DOMAIN}_all_subs.txt"
wc -l "${DOMAIN}_all_subs.txt"
Continuous monitoring loop for new assets:
#!/bin/bash
DOMAIN=$1
DATE=$(date +%F)
assetfinder --subs-only "$DOMAIN" | sort -u > "assets_${DATE}.txt"
PREV=$(ls -t assets_*.txt 2>/dev/null | sed -n 2p)
if [ -n "$PREV" ]; then
comm -13 "$PREV" "assets_${DATE}.txt" > "new_assets_${DATE}.txt"
[ -s "new_assets_${DATE}.txt" ] && echo "[+] New assets detected:" && cat "new_assets_${DATE}.txt"
fi
Tips and Best Practices
- Always use
--subs-onlyin automated pipelines — without it, unrelated root domains can pollute your results and downstream tooling. - Never rely on Assetfinder alone for exhaustive enumeration; it is best used as one of several tools (alongside Amass/Subfinder) whose outputs are merged and deduplicated.
- Because it has no built-in output/threading options, always redirect (
>) or pipe (|) its output — don’t expect JSON or structured formats. - Combine with
anew(another TomNomNom tool) instead of manualcomm/diffscripting for cleaner continuous-monitoring workflows.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
command not found: assetfinder | Go bin directory not in $PATH | Run export PATH=$PATH:$(go env GOPATH)/bin and add it to your shell profile |
| No output at all | Domain has no passive DNS/Certificate Transparency footprint, or network/DNS issue | Verify internet connectivity; test with a well-known domain like google.com first |
| Output includes irrelevant/unrelated domains | Ran without --subs-only, so related root domains are also shown | Always pass --subs-only when only subdomains of the target are wanted |
| Slow response times | Upstream passive data source (e.g., crt.sh) is under heavy load | Retry after a short delay; this is an upstream availability issue, not a local bug |
References
- Official GitHub repository: https://github.com/tomnomnom/assetfinder
- TomNomNom’s tool ecosystem overview: https://github.com/tomnomnom
- Kali Linux tool page: https://www.kali.org/tools/assetfinder/
