Sublist3r is an open-source subdomain enumeration tool developed by Aboul3la. It discovers subdomains using multiple public search engines, OSINT services, and certificate transparency sources. It primarily performs passive enumeration but also supports optional brute-force enumeration to discover additional subdomains.

Purpose

The primary purpose of Sublist3r is to discover subdomains associated with a target domain using publicly available OSINT sources. It helps security professionals expand the target's attack surface during the reconnaissance phase.

Key Features

• Passive subdomain enumeration
• Multiple search engine support
• Certificate Transparency lookups
• Optional brute-force enumeration
• Optional port scanning
• Supports search engine aggregation
• Open source
• Cross-platform support
• Simple command-line interface

Passive / Active Enumeration

Sublist3r primarily performs passive enumeration by querying publicly available search engines and OSINT sources.

It also supports optional active enumeration through brute-force techniques, allowing it to discover additional subdomains that may not be publicly indexed.