Discovering subdomains of a domain is an essential part of hacking reconnaissance and thanks to following online tools which make the life easier.
Having unsecured subdomain can lead to serious risk to your business and lately, there were a number of security incidents where the hacker used subdomains tricks.
If you are a website owner or security researcher, you can use the following tools to find the subdomains of any domain.
Censys is probably one of the first search engines to check for subdomains. Along with subdomain, you can also find some of the interesting stuff as following.
- IP details (can be useful to find origin IP)
- Certificate details
- Allowed port
- SSL/TLS handshake protocol and cipher suites (useful to find weak cipher/protocol)
You can have a nice summary report of the domain.
Pentest-tools search for subdomain using multiple methods like DNS zone transfer, DNS enumeration based on wordlist and public search engine.
You can save the output in PDF format.
3. DNS Dumpster
DNSDumpster is a domain research tool to find host related information. It’s HackerTarget.com project.
Not just subdomain but it gives you information about DNS server, MX record, TXT record and nice mapping about your domain.
Sublist3r is python tool to find subdomains using a search engine. Currently, it supports Google, Yahoo, Bing, Baidu, Ask, Netcraft, Virustotal, ThreatCrowd, DNSdumpster and PassiveDNS.
Sublist3r is supported only on python 2.7 version and have few dependencies in a library.
You can use this tool on Windows, CentOS, Rehat, Ubuntu, Debian or any other UNIX based OS. Following example is from CentOS/Linux.
- Login into your Linux server
- Download latest Sublist3r
Extract the downloaded file
- It will create new folder called “Sublist3r-master”
As I mentioned earlier, it has the following dependencies and you can install it using a yum command.
yum install python-requests python-argparse
Now you are set to discover the subdomain by using the following command.
./sublist3r.py -d yourdomain.com
As you can see it did discover my subdomains.
Netcraft has a large number of a domain database and you don’t want to miss this in finding public subdomain information.
The search result will contain all the domain and subdomain with first seen, netblock and OS information. If you need more information about the website then just click on site report and you will be given tons of information about technologies, ranking, etc.
CloudPiercer would be helpful sometimes to find if subdomain exists of your domain. BTW, CloudPiercer is fantastic and easy way to find if your website origin IP is exposed. Having origin IP exposed can invite hacker to prepare for a DDoS attacks.
Detectify can scan subdomains against few hundreds pre-defined word but you can’t do this to a domain which you don’t own. However, if you are authorized user then you can enable subdomain discovery in overview under settings.
SubBrute is one of the most popular and accurate subdomain enumeration tools. It’s community driven project and it uses open resolver as a proxy so SubBrute doesn’t send traffic to the domain’s name servers.
It’s not an online tool and you need to install this on your computer. You can use on Windows or UNIX based OS and installation is very easy. The following demonstration is based on CentOS/Linux.
- Login into your CentOS/Linux
- Download the latest SubBrute
- Unzip the downloaded zip file
It will create a new folder called “subbrute-master”. Go inside the folder and execute the subbrute.py with the domain.
It will take few seconds and result in you with any subdomain found.
Knock is another python based subdomain discovery tool which is tested with python 2.7.6 version. It finds the subdomain of a target domain using a wordlist.
- You can download and install this on Linux based OS.
- Extract the downloaded zip file with unzip command
- it will extract and create new folder “knock-knock3”
- Go inside this folder and install with the following command
python setup.py install
Once installed, you can scan for subdomains by following
10. DNSRecon on Kali Linux
Kali Linux is a great platform for security researcher and you can use DNSRecon on Kali without installing anything.
It checks all NS records for zone transfers, general DNs records, wildcard resolution, PTR record , etc.
To use DNSRecon, just execute the following and you are all done.
dnsrecon –d yourdomain.com
I hope by using above tools you should be able to discover subdomains of the target domain for your security research. Let me know which one you like the most.