otlite · Domain and DNS
Install Sublist3r on Linux or macOS in one command
Sublist3r collects a domain's subdomains from search engines, certificate logs, and public lookup sites. It prints one deduplicated hostname list, with optional brute forcing (-b) and port checks (-p) on top.
Sublist3r in three lines
pipx install otlite
otlite install sublist3r
otlite run sublist3r -- d:example.comRuns aboul3la/Sublist3r (GPL-2.0, ★ 11k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.
What Sublist3r is for
- A quick passive subdomain list for a domain you are assessing.
- Cross-checking ctfr or theHarvester output against different sources.
- Saving hostnames to a file (-o) for resolution or screenshots later.
Typed inputs for Sublist3r
otlite translates these prefixes into Sublist3r's own flags. Anything else after -- is passed through unchanged, so every original flag still works.
- d:
- Domain ·
otlite run sublist3r -- d:example.com
Run every installed tool that takes the same input at once: otlite run --all d:example.com
Where the results go
Every run lands under ./results/sublist3r/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff sublist3r <target>, and pull indicators out with otlite extract sublist3r.
Before you run it
- Upstream changes slowly and some of its sources have shut down or block scripted queries, so expect several engines to return nothing.
- Brute forcing (-b) and port checks (-p) send traffic to the target's DNS servers and hosts. Leave them off for passive work.
Update, remove, inspect
otlite info sublist3r # inputs, keys, an example command
otlite example sublist3r # sample output, where there is one
otlite update sublist3r # move to the next tested version
otlite remove sublist3r # delete its virtualenvFull reference: the otlite docs, and the tool's own README on GitHub.
Pairs with
When open-source isn't enough
Sublist3r lists the names public sources happen to know. SearchIn's DNS providers return current and historical records for each, and subdomains the search engines never indexed.
FAQ
Sublist3r with otlite, answered
How do I install Sublist3r on Kali, Ubuntu, or macOS?
Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install sublist3r. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.
Which inputs does Sublist3r take through otlite?
d: (domain). otlite maps each prefix to Sublist3r's own flag. Everything after -- that is not a typed input is passed through unchanged, so the original flags still work.
Where does otlite save Sublist3r results?
Under ./results/sublist3r/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff sublist3r <target> to compare the last two.
Does Sublist3r need an API key or a login?
No key is required for the basic run. Optional keys, where the project supports them, go in with otlite keys set NAME and are passed only to tools that declare them.
Can I run Sublist3r together with other tools?
Yes. otlite run --all d:example.com runs every installed tool that takes domain input, in parallel, including Sublist3r. Save the combination as a playbook to repeat it.