The Rust-Powered Subdomain Enumerator That Combines Speed, Stealth, and Precision

Voyage is a subdomain enumeration tool written in Rust that merges active and passive scanning to maximize discovery with minimal noise. Designed for both performance and flexibility, it automates reconnaissance across multiple sources while remaining fully customizable.

Full Breakdown: What Voyage Actually Does

Voyage is not just another subdomain discovery script. It’s a hybrid enumeration engine that balances brute force capability with passive intelligence-gathering, enabling security professionals to identify a wide range of subdomains while minimizing redundant or intrusive requests.

At its core, Voyage automates the reconnaissance process of uncovering hidden subdomains linked to a domain name. These subdomains often expose staging servers, admin panels, dev environments, and APIs that attackers can exploit if discovered. Most people rely on either passive methods (public databases, certificate logs, threat intelligence feeds) or active methods (brute-forcing DNS names) to find them. Voyage does both simultaneously.

Unlike basic enumeration tools that repeat the same queries or hit rate limits, Voyage tracks scan progress intelligently, avoiding redundant requests across sessions. This is key for large-scale or long-term reconnaissance, especially in red team operations or bug bounty engagements where efficiency matters.

Key Features

➣ Stateless Enumeration Engine
Voyage remembers what’s already been scanned across sessions. This prevents wasted queries and significantly speeds up large-scale scans.

➣ Hybrid Engine
It combines brute-force methods with passive data collection. Passive sources include online APIs and OSINT feeds. Brute-force options target DNS servers directly. The tool runs both simultaneously or individually, depending on user preference.

➣ Configurable Performance
Every element is tunable: thread counts, request rates, timeouts. Users can optimize for either speed or stealth, which is crucial for avoiding detection during recon.

➣ Selectable Sources
You’re not locked into a monolithic scan. You can pick only passive or only brute-force, or even exclude specific enumeration techniques or providers.

➣ Local Database
Voyage uses a local cache to track what’s already been discovered. This allows for faster follow-up scans and prevents data loss during interruptions.

➣ Flexible Output
It supports plaintext or CSV exports, making integration with other tools and reporting pipelines simple.

Installation

Voyage runs on Linux, macOS, and Windows. Installation options include:

• Shell script (Linux/macOS):
  curl -fsSL https://raw.githubusercontent.com/... | bash
• Windows (scoop):
  scoop install voyage
• From Source:
  Clone the repo and build it with Rust's cargo tool.
• Prebuilt binaries:
  Available on the Releases page.

Usage

Basic scan:
voyage -d example.com -o ./path/to/output.txt

Chain multiple domains:
cat domains.txt | xargs -I{} voyage -d {} -o ./path/to/output.txt

Adjust performance:
voyage -d example.com -t 64 -r 100

Clear cache and launch fresh scan:
voyage -d example.com --fresh-start

Output formats include:

• Text (default)
• CSV
  Example:
  voyage -d example.com --output-format csv -o results.csv

What Sets Voyage Apart

Most tools force a tradeoff between speed, stealth, and thoroughness. Voyage rejects that compromise. It allows full control of scan mechanics while automating progress tracking and session persistence. That means fewer repeated requests, less noise in DNS logs, and more precise coverage. Rust also makes it significantly faster and more efficient than older tools written in Python or Bash.

This is a reconnaissance tool made for serious operators whether you're doing OSINT, penetration testing, or simply mapping your own infrastructure for security auditing. The point isn’t just to discover subdomains, but to do it in a way that’s clean, customizable, and tactical.

License and Source
Voyage is open-source, licensed under GNU GPLv3. Full source code is available at https://github.com/clickswave/voyage

For real-world use, keep your scans targeted and your thread counts realistic especially on monitored environments. Just because it’s fast doesn’t mean it should be noisy.