otinstaller · Domain and DNS

Install ctfr on Linux in one command

ctfr lists the subdomains of a domain by reading Certificate Transparency logs through crt.sh. Nothing touches the target; it only asks the public log index.

ctfr in three lines

pipx install otinstaller
ot install ctfr
ot run ctfr -- d:example.com

Runs UnaPibaGeek/ctfr (GPL-3.0, ★ 2.1k, otinstaller v0.0.4, registry updated Oct 13, 2026). otinstaller installs and runs it; it does not change or verify it.

What ctfr is for

Quick passive subdomain lists.
Seeding BBOT or dnsgen with known names.

Typed inputs for ctfr

otinstaller translates these prefixes into ctfr's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

d:: domain · ot run ctfr -- d:example.com

Run every installed tool that takes the same input at once: ot run --all d:example.com

Where the results go

Every run lands under ./results/ctfr/<target>/ as a timestamped output file plus a .meta.json sidecar: the exact command, start and end time, exit code, and the SHA-256 of the output. Group runs with --case, compare the last two with ot diff ctfr <target>, and pull indicators out with ot extract.

Before you run it

crt.sh is sometimes slow or rate limited; retry later rather than hammering it.

Update, remove, inspect

ot info ctfr      # inputs, flags, keys
ot example ctfr   # sample output
ot update ctfr    # move to the next tested version
ot remove ctfr    # delete its virtualenv

Full reference for this tool: docs for ctfr.

Pairs with

BBOT

BBOT is a recursive scanner that starts from a domain or IP, discovers subdomains, hosts, and services, and feeds each finding back in as a new target.

dnsgen

dnsgen takes a list of known subdomains and generates plausible permutations: numbers, environments, regions, and common words.

Fierce

Fierce brute-forces subdomains with a wordlist, tries zone transfers, and scans the IP space around the hosts it finds for more names.

When open-source isn't enough

ctfr reads one public log. SearchIn's DNS providers return current and historical records and the subdomains the logs never saw.

SecurityTrails

Domain intelligence

WhoisXML

Domain intelligence

See SearchIn

FAQ

ctfr with otinstaller, answered

How do I install ctfr on Kali or Ubuntu?

Install otinstaller once with pipx install otinstaller, run ot init, then ot install ctfr. The tool lands in its own virtualenv under ~/.otinstaller/, pinned to a version that was tested on Ubuntu, so nothing touches your system Python. ot doctor flags a missing git or venv module.

Which inputs does ctfr take through otinstaller?

d: (domain). otinstaller maps each prefix to ctfr's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otinstaller save ctfr results?

Under ./results/ctfr/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar with the exact command, timing, exit code, and SHA-256. Add --case <name> to group runs, and ot diff ctfr <target> to compare the last two.

Does ctfr need an API key or a login?

No key is required for the basic run. Optional keys, where the project supports them, go in ~/.otinstaller/.env and are passed only to tools that declare them.

Can I run ctfr together with other tools?

Yes. ot run --all d:example.com runs every installed tool that accepts domain input, in parallel, including ctfr. Save the combination as a playbook to repeat it.