Scan engines · Subdomain enumeration

voyage

Finds a domain’s subdomains from public intelligence and from a wordlist at the same time, and records which source confirmed each one.

Daemon port: 4442
Licence: Apache-2.0
Install: crossfyre extension install voyage

Contents

Passive sources Active enumeration Standalone usage Key options Output

voyage maps a domain's subdomains two ways at once. Passive enumeration pulls known hostnames from public intelligence sources; active enumeration brute-forces candidates from a wordlist and confirms the ones that resolve. Each discovered subdomain is reported with the source that found it, so you know whether it came from certificate transparency, passive DNS, or a live resolution. It is usually the first stage of a run: its output is the target list everything downstream works from.

Passive sources

Passive enumeration is fast, quiet, and needs no wordlist. voyage queries public sources and keeps only real subdomains of your target:

crt.sh: certificate-transparency logs, so every hostname that ever appeared in a TLS certificate for the domain.
hackertarget: passive DNS and host search.
AlienVault OTX: passive DNS records.

No API keys are required. Drop a single source with --exclude-passive-source, or skip passive entirely with --disable-passive-enum.

Active enumeration

Active enumeration takes each word in your wordlist, forms word.domain, and confirms it with a sequence of techniques. The first technique that succeeds marks the host found and records which one confirmed it:

ipv4_lookup / ipv6_lookup: DNS A / AAAA resolution.
http_probing / https_probing: an HTTP / HTTPS request on the ports you choose (defaults 80 / 443).

Exclude any technique with --exclude-active-technique, or skip the active phase with --disable-active-enum. You cannot disable both phases at once.

Standalone usage

voyage --daemon &                      # start the engine (port 4442)

# passive sources + active brute-force
voyage scan -d example.com -w ./subdomains.txt -t 32

# passive only (no wordlist needed)
voyage scan -d example.com --disable-active-enum

# active only, on custom probe ports
voyage scan -d example.com -w ./sub.txt --disable-passive-enum --http-probing-port 80,8080 --https-probing-port 443,8443

Key options

Option	What it does
`-d, --domain`	Target domain to enumerate.
`-w, --wordlist-path`	Wordlist for the active brute-force. Required unless active is disabled.
`-t, --tasks`	Concurrent workers for the active phase.
`--disable-passive-enum` `--disable-active-enum`	Turn either phase off, but not both.
`--exclude-passive-source`	Drop a source: crt.sh, hackertarget or alienvault.
`--exclude-active-technique`	Drop a technique: ipv4_lookup, ipv6_lookup, http_probing, https_probing.
`--http-probing-port` `--https-probing-port`	Ports the HTTP / HTTPS probes hit. Defaults 80 / 443.
`--fresh-start`	Discard saved state and start clean. The default resumes.

Output

Each finding is a subdomain plus the source that confirmed it. Results stream to the live UI and into the toolchain database; on the platform they land in the shared asset graph and become the seed for the next stage. Passive and active results are merged and de-duplicated, so a host found by both counts once.