<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Subdomain Enumeration

## crt.sh (Certificate Transparency)

### Query Subdomains
```bash
curl -s "https://crt.sh/?q=%.example.com&output=json" | jq -r '.[].name_value' | sort -u
```

### Wildcard Search
```bash
curl -s "https://crt.sh/?q=%25.example.com&output=json&exclude=expired"
```

## SecurityTrails API

### List Subdomains
```bash
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domain/example.com/subdomains" \
  | jq -r '.subdomains[]'
```

### DNS History
```bash
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/history/example.com/dns/a"
```

## Subfinder

### Basic Enumeration
```bash
subfinder -d example.com -silent -all -o subs.txt
```

### With Specific Sources
```bash
subfinder -d example.com -sources shodan,virustotal,securitytrails
```

### Provider Config
```yaml
# ~/.config/subfinder/provider-config.yaml
securitytrails:
  - YOUR_API_KEY
shodan:
  - YOUR_API_KEY
virustotal:
  - YOUR_API_KEY
censys:
  - YOUR_API_ID:YOUR_API_SECRET
```

## Amass

### Passive Enumeration
```bash
amass enum -passive -d example.com -o amass_subs.txt
```

### With Config
```bash
amass enum -passive -d example.com -config amass_config.ini
```

## DNSx

### Resolve Subdomains
```bash
dnsx -l subs.txt -silent -a -resp -o resolved.txt
```

### Brute-Force
```bash
dnsx -d example.com -w wordlist.txt -silent -a -resp
```

### CNAME Check
```bash
dnsx -l subs.txt -cname -resp -o cnames.txt
```

## PureDNS

### Brute-Force with Resolution
```bash
puredns bruteforce wordlist.txt example.com -r resolvers.txt -w results.txt
```

### Resolve Existing List
```bash
puredns resolve subs.txt -r resolvers.txt -w resolved.txt
```

## HTTPx

### Probe Live Hosts
```bash
httpx -l resolved.txt -silent -sc -title -tech-detect -fr -o live.txt
```

### With Screenshot
```bash
httpx -l resolved.txt -screenshot -system-chrome
```

## Environment Variables

| Variable | Description |
|----------|-------------|
| `SECURITYTRAILS_KEY` | SecurityTrails API key |
| `SHODAN_API_KEY` | Shodan API key |
| `CENSYS_API_ID` | Censys API ID |
| `CENSYS_API_SECRET` | Censys API secret |
| `VT_API_KEY` | VirusTotal API key |
