OSINT › Module 6 › Lesson 3
subfinder Amass and assetfinder on YOUR Domain
Passive finders exist — point them only at a zone in YOUR scope file.
Visual · ct_subfinder_amass
subfinder, OWASP Amass, assetfinder, findomain = inventory helpers for YOUR domain. GATE 192.168.0.1.
Opening
The binary does not know your RoE. You have to feed it a name you are allowed to own.
ProjectDiscovery subfinder, OWASP Amass, tomnomnom assetfinder, and findomain are well-known collectors. In Cyberlium they are optional tools for a domain listed in YOUR t12-scope.yaml. If the binary is missing, bookmark the official GitHub and stop. Installing them is not homework to unleash on a corporation “because OSINT is public.” Original Cyberlium. Teaching bind never 0.0.0.0. NEVER mass-enum someone else's corp, never nmap a /24 to “confirm” findings, never hydra names you collected. Next: Lab — CT and Subdomain Notes YOU Own.
1. Name the four finders, then name the only allowed target class
subfinder lives at https://github.com/projectdiscovery/subfinder. OWASP Amass lives at https://github.com/owasp-amass/amass. assetfinder is the tomnomnom helper. findomain is named here as another passive finder. Official pages first. Random “subdomain killer” blogs last, meaning never.
Allowed target: a DNS zone YOU own or are written-authorized to inventory, copied from t12-scope.yaml. example.com remains literacy for CT, not a brute-force playground. A classmate's startup is not “practice.”
Command guide
Name the four finders, then name the only allowed target class
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/owasp-amass/amass/v4/...@master
macOS:
Command — copy this
brew install subfinder brew install amass
Windows:
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/owasp-amass/amass/v4/...@master
═══ LINUX / macOS ═══
Passive subdomain enumeration
Command — copy this
subfinder -d example.com -silent subfinder -d example.com -o subdomains.txt
OWASP Amass (passive mode)
Command — copy this
amass enum -passive -d example.com
Assetfinder
Command — copy this
assetfinder --subs-only example.com
═══ WINDOWS ═══
Command — copy this
subfinder -d example.com -silent amass enum -passive -d example.com
2. Optional commands, mandatory ethics
If and only if YOUR scope file has a domain you control, passive collection is the Cyberlium shape: subfinder with a timeout, Amass in passive mode, assetfinder, findomain. No brute wordlists against third parties. No “active” mode against a neighbor. No piping results into hydra.
If go/pipx install is something you choose later, use the official repositories only. Do not run a finder against 192.168.0.1. Routers are not DNS zones. GATE already told you to STOP if that URL was Router Admin.
3. What “passive” does not mean
Passive in this academy means: query public sources and YOUR own DNS view, do not blast the target with brute force, do not scan ports, do not try default passwords. Public source still does not mean “any company.” It means sources applied to an in-scope name.
You will not bind a teaching helper to 0.0.0.0 so classmates can watch your Amass. They run their own scope. Stalking someone's hobby domain because you know their handle from Module 2 is still stalking.
4. What you ship: named finders plus a skip-or-owned-domain decision
Official URLs recorded. command -v results noted. Live finder commands only if YOUR domain is in scope and not example.com-as-target. chmod 600. No /24, no hydra.
5. What you record before the next lesson
Date. Finders named. DOMAIN from scope or SKIP. DEMO GATE. SAFE File t12-m06-l03-finders.txt.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
amass enum against a unicorn startup “for the writeup.” findomain a classmate's shop. Pipe assetfinder into hydra.
Right
Bookmark official repos. Run finders only on YOUR domain or skip. Next: Lab — CT and Subdomain Notes YOU Own.
Mission: decide skip vs YOUR zone before any finder
1) / STOP if router. 2) Check command -v for subfinder, amass, assetfinder, findomain. 3) If t12-scope.yaml has YOUR domain, you may run passive finders; otherwise skip. Never mass-enum a corp you do not own.
Stuck? Ask Cyberlium AI Mentor
If go is missing, ask Mentor for an official install bookmark — not for a pre-built “corp enum” script.
Knowledge Check
APPLY: t12-scope.yaml has no domain key. You:
Multiple choice
Knowledge Check
APPLY: True or False: “Passive” means you may inventory any company in Certificate Transparency.
True or False
Knowledge Check
APPLY: A roommate asks you to Amass their employer “quietly.” You:
Multiple choice