otlite · Domain and DNS

Install ctfr on Linux or macOS in one command

ctfr lists the subdomains of a domain by reading Certificate Transparency logs through crt.sh. Nothing touches the target; it only asks the public log index.

ctfr in three lines

pipx install otlite
otlite install ctfr
otlite run ctfr -- d:example.com

Runs UnaPibaGeek/ctfr (GPL-3.0, ★ 2.1k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.

What ctfr is for

Quick passive subdomain lists.
Seeding BBOT or dnsgen with known names.

Typed inputs for ctfr

otlite translates these prefixes into ctfr's own flags. Anything else after -- is passed through unchanged, so every original flag still works.

d:: Domain · otlite run ctfr -- d:example.com

Run every installed tool that takes the same input at once: otlite run --all d:example.com

Where the results go

Every run lands under ./results/ctfr/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff ctfr <target>, and pull indicators out with otlite extract ctfr.

Before you run it

crt.sh is sometimes slow or rate limited; retry later rather than hammering it.

Update, remove, inspect

otlite info ctfr      # inputs, keys, an example command
otlite example ctfr   # sample output, where there is one
otlite update ctfr    # move to the next tested version
otlite remove ctfr    # delete its virtualenv

Full reference: the otlite docs, and the tool's own README on GitHub.

Pairs with

BBOT

BBOT is a recursive scanner that starts from a domain or IP, discovers subdomains, hosts, and services, and feeds each finding back in as a new target.

dnsgen

dnsgen takes a list of known subdomains and generates plausible permutations: numbers, environments, regions, and common words.

Fierce

Fierce brute-forces subdomains with a wordlist, tries zone transfers, and scans the IP space around the hosts it finds for more names.

When open-source isn't enough

ctfr reads one public log. SearchIn's DNS providers return current and historical records and the subdomains the logs never saw.

SecurityTrails

Domain intelligence

WhoisXML

Domain intelligence

See SearchIn

FAQ

ctfr with otlite, answered

How do I install ctfr on Kali, Ubuntu, or macOS?

Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install ctfr. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.

Which inputs does ctfr take through otlite?

d: (domain). otlite maps each prefix to ctfr's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.

Where does otlite save ctfr results?

Under ./results/ctfr/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff ctfr <target> to compare the last two.

Does ctfr need an API key or a login?

No key is required for the basic run. Optional keys, where the project supports them, go in with otlite keys set NAME and are passed only to tools that declare them.

Can I run ctfr together with other tools?

Yes. otlite run --all d:example.com runs every installed tool that takes domain input, in parallel, including ctfr. Save the combination as a playbook to repeat it.