---
title: Identifiers - Listing Subdomains
slug: identifiers-listing-subdomains
description: Learn how to list subdomains using the Flare tool in this helpful document. Discover how the tool utilizes Amass to access third-party services for subdomain enumeration, but be cautious when using it for sensitive domains due to potential disclosure of i
docTags: 
createdAt: 2023-10-02T16:59:53.641Z
---

# Listing Subdomains

When you create a Domain type Identifier, Flare will run queries to passively collect all available subdomains. The tool currently uses Amass ([https://github.com/OWASP/Amass](https://github.com/OWASP/Amass)) to access third-party services that provide subdomain enumeration. 

:::hint{type="warning"}
## Avoid sensitive domains

The subdomain enumeration feature should not be used for any confidential or sensitive domain name since the information is disclosed to third-party services, as listed below. 
:::

The tool is configured to collect subdomains only passively. This means two things:

1. There are no requests, DNS or other active scan done on the target host.
2. There might be results missing when compared to more intrusive/active subdomain enumeration methods.

The tool uses the following data sources for the enumeration process:

- AlienVault ([https://otx.alienvault.com/](https://otx.alienvault.com/))
- Certspotter ([https://sslmate.com/certspotter/](https://sslmate.com/certspotter/))
- Certsh ([https://crt.sh/](https://crt.sh/))

# Related Articles

:::CtaButton{label="Identifiers" docId="DGkccVRbCbEYxLeaDWamU" openInNewTab="true"}

:::

:::CtaButton{label="Configure Identifiers" docId="BpcMrPdOHzER0cC83VCdn" openInNewTab="true"}

:::

:::CtaButton{label="Configure Identifiers - Advanced" docId="njPo9RJxku7p33xZfxmjz" openInNewTab="true"}

:::