Quick Start Guide for Pius

Pius discovers domains and IP ranges for an organization using passive OSINT by default. This guide walks through running your first discovery.

Basic usage

Run a passive discovery with just an organization name:

pius run --org "Acme Corp"

Add a domain hint for more results

Providing a known domain unlocks additional plugins like certificate transparency and DNS-based discovery:

pius run --org "Acme Corp" --domain acme.com

Enable active plugins

Active plugins perform DNS brute-force, zone transfers, and DoH enumeration. Enable them with --mode:

pius run --org "Acme Corp" --domain acme.com --mode all

Example output

[domain] acme.com (crt-sh)
[domain] api.acme.com (crt-sh)
[domain] staging.acme.com (passive-dns)
[domain] acme.com (reverse-whois) ⚠ needs-review [confidence:0.42]
[cidr] 203.0.113.0/24 (arin)
[cidr] 198.51.100.0/22 (ripe)

Findings marked needs-review have a confidence score between 0.35 and 0.65, indicating an ambiguous match that should be verified manually.

Output formats

Pius supports three output formats:

# Terminal table (default, human-readable)
pius run --org "Acme Corp"

# JSON array
pius run --org "Acme Corp" --output json

# NDJSON (one object per line, ideal for piping)
pius run --org "Acme Corp" --output ndjson

# Filter NDJSON with jq
pius run --org "Acme Corp" --output ndjson | jq 'select(.type == "cidr")'

Select specific plugins

# Run only specific plugins
pius run --org "Acme Corp" --plugins crt-sh,apollo,arin

# Disable specific plugins
pius run --org "Acme Corp" --disable edgar,dns-brute

What's next?

• Plugins - See all 23 discovery plugins and what they do
• Configuration - Set up API keys to unlock more plugins
• Architecture - Understand how the three-phase pipeline works