Identifiers - Listing Subdomains

listing subdomains when you create a domain type identifier, flare will run queries to passively collect all available subdomains the tool currently uses amass ( https //github com/owasp/amass https //github com/owasp/amass ) to access third party services that provide subdomain enumeration avoid sensitive domains the subdomain enumeration feature should not be used for any confidential or sensitive domain name since the information is disclosed to third party services, as listed below the tool is configured to collect subdomains only passively this means two things there are no requests, dns or other active scan done on the target host there might be results missing when compared to more intrusive/active subdomain enumeration methods the tool uses the following data sources for the enumeration process alienvault ( https //otx alienvault com/ https //otx alienvault com/ ) certspotter ( https //sslmate com/certspotter/ https //sslmate com/certspotter/ ) certsh ( https //crt sh/ https //crt sh/ ) related articles