Chaos Command Guide

Chaos is a project discovery tool that interacts with the Chaos API (by ProjectDiscovery) to retrieve subdomains. It allows for instant enumeration if you have an API key.

Top 10 Useful Commands

1. Basic Fetch

chaos -d example.com

Explanation: Fetches subdomains for the target from the Chaos dataset.

2. Download Everything

chaos -d example.com -o output.txt

Explanation: Saves the dataset to a file.

3. Filter by Bug Bounty Programs

chaos -bbq

Explanation: Lists all domains currently in public bug bounty programs indexed by Chaos.

4. Count Subdomains

chaos -d example.com -count

Explanation: Returns only the count of subdomains found, not the list.

5. Check API Key

chaos -key

Explanation: Checks if your PDCP_API_KEY is configured correctly.

6. JSON Output

chaos -d example.com -json

Explanation: Outputs data in JSON format for easy parsing by other tools.

7. Silent Mode

chaos -d example.com -silent

Explanation: Prints only the subdomains, no banners or metadata.

8. Fetch New Only

chaos -d example.com -new

Explanation: (If supported by easier version) Filters to show only newly added subdomains since last check.

9. Filter with Grep

chaos -d example.com | grep "dev"

Explanation: combine with standard linux tools to find interesting patterns like "dev" or "staging".

10. Piping to Httpx

chaos -d example.com | httpx

Explanation: Immediately check which of the chaos-found domains are alive.

The Most Powerful Command

chaos -d example.com -silent | httpx -title -tech-detect -status-code

Explanation: Instantly retrieves thousands of subdomains and fingerprints the technology and status of every single one.