Subdomain Discovery Tool

Discover subdomains using multiple advanced techniques including DNS brute-force, certificate transparency logs, and search engine data. Includes subdomain takeover detection and ethical scanning practices.

Subdomain Discovery Configuration

Enter domain without http:// or https://
Maximum number of subdomains to discover (10-1000)
Delay between requests to avoid overwhelming servers
Timeout for each request in seconds (5-30)
One subdomain per line. Leave empty to use default wordlist.

About Subdomain Discovery

What is subdomain discovery?

Subdomain discovery is the process of finding subdomains of a target domain. Subdomains can reveal additional attack surfaces, forgotten services, development environments, and potential security vulnerabilities that may not be obvious from the main domain.

Why is subdomain discovery important?

  • Security Assessment - Identify all assets belonging to an organization
  • Attack Surface Mapping - Discover potential entry points for security testing
  • Asset Management - Maintain inventory of all subdomains and services
  • Vulnerability Research - Find forgotten or misconfigured services

Who uses subdomain discovery tools?

  • Security Researchers - For authorized penetration testing and bug bounty hunting
  • System Administrators - To audit their organization's digital footprint
  • DevOps Teams - For asset inventory and security compliance
  • Cybersecurity Professionals - For threat hunting and incident response

How to use this tool

  1. Enter target domain - Specify the domain you want to scan (ensure you have permission)
  2. Configure scan options - Select discovery methods and adjust rate limiting
  3. Set ethical limits - Configure maximum subdomains and request timeouts
  4. Start discovery - Begin the comprehensive subdomain enumeration
  5. Review results - Analyze discovered subdomains and potential vulnerabilities
  6. Export findings - Save results for further analysis or reporting

Discovery Methods Explained

DNS Brute Force

Tests common subdomain names against the target domain using DNS resolution. Uses a comprehensive wordlist of common subdomain patterns.

Certificate Transparency

Queries Certificate Transparency logs to find subdomains that have been issued SSL certificates. Very effective for discovering legitimate subdomains.

Search Engines

Uses search engine results to discover subdomains that have been indexed. Helps find publicly accessible subdomains.

Permutation Scanning

Generates variations of discovered subdomains using common patterns like dev-, test-, staging-, etc.

Ethical Usage Guidelines

Legal and Responsible Usage
  • Only scan domains you own or have explicit written permission to test
  • Respect rate limits and avoid overwhelming target servers
  • Use appropriately between requests to minimize impact
  • Do not use discovered information for malicious purposes
  • Report vulnerabilities responsibly through proper channels
  • Comply with all applicable laws and regulations

Subdomain Takeover Detection

This tool includes detection for potential subdomain takeover vulnerabilities, which occur when a subdomain points to a service that is no longer active but can be claimed by an attacker.

Common Vulnerable Services
  • GitHub Pages
  • Heroku applications
  • AWS S3 buckets
  • Azure websites
  • CloudFront distributions
Risk Indicators
  • CNAME pointing to external service
  • 404 or 403 HTTP responses
  • Service-specific error messages
  • Unclaimed service instances