• Get application security done the right way! Detect, Protect, Monitor, Accelerate, and more…
  • Discovering subdomains of a domain is an essential part of hacking reconnaissance, and thanks to following online tools which make life easier.

    Having an unsecured subdomain can lead to a serious risk to your business, and lately, there were some security incidents where the hacker used subdomains tricks.

    The most recent one was Vine, where the entire code was available to download from a vulnerably exposed subdomain.

    If you are a website owner or security researcher, you can use the following tools to find the subdomains of any domain.

    DNS Dumpster

    DNSDumpster is a domain research tool to find host-related information. It’s the HackerTarget.com project.

    Not just subdomain, but it gives you information about DNS server, MX record, TXT record, and nice mapping of your domain.

    dnsdumpster

    NMMAPPER

    An online tool to find subdomain using Anubis, Amass, DNScan, Sublist3r, Lepus, Censys, etc.

    I tried NMMAPPER for one of the domains, and results were accurate. Go ahead and give a try for your research works.

    Spyse

    Subdomain Finder by Spyse is a handcrafted search engine that allows you to discover subdomains of any domain. It is just one of several tools made by Spyse, and it’s closely connected to all other tools that allow you to get much more info about subdomains.

    ImmuniWeb

    Finding a subdomain is easy with SSLScan. You provide the URL to scan, and within a few seconds, results are shown with discovered subdomain along with other SSL information.

    Domains scanning is powered by the ImmuniWeb AI platform.

    Sublist3r

    Sublist3r is a python tool to find subdomains using a search engine. Currently, it supports Google, Yahoo, Bing, Baidu, Ask, Netcraft, Virustotal, ThreatCrowd, DNSdumpster, and PassiveDNS.

    Sublist3r is supported only on python 2.7 version and has few dependencies in a library.

    You can use this tool on Windows, CentOS, Rehat, Ubuntu, Debian, or any other UNIX based OS. The following example is from CentOS/Linux.

    • Login to your Linux server
    • Download latest Sublist3r
    wget https://github.com/aboul3la/Sublist3r/archive/master.zip .

    Extract the downloaded file

    unzip master.zip
    • It will create a new folder called “Sublist3r-master”

    As I mentioned earlier, it has the following dependencies, and you can install it using a yum command.

    yum install python-requests python-argparse

    Now you are set to discover the subdomain by using the following command.

    ./sublist3r.py -d yourdomain.com

    sublist3r

    As you can see, it did discover my subdomains.

    Netcraft

    Netcraft has a large number of a domain database, and you don’t want to miss this in finding public subdomain information.

    The search result will contain all the domain and subdomain with first seen, netblock, and OS information.

    If you need more information about the website, then click on site report, and you will be given tons of information about technologies, ranking, etc.

    netcraft-results

    CloudPiercer

    CloudPiercer would be helpful sometimes to find if the subdomain exists in your domain. BTW, CloudPiercer is a fantastic and easy way to see if your website origin IP is exposed. Having origin IP exposed can invite hackers to prepare for DDoS attacks.

    Detectify

    Detectify can scan subdomains against a few hundreds of pre-defined words, but you can’t do this to a domain which you don’t own.

    However, if you have authorized a user, then you can enable subdomain discovery in the overview under settings.

    detectify-subdomain

    SubBrute

    SubBrute is one of the most popular and accurate subdomain enumeration tools. It’s a community-driven project, and it uses the open resolver as a proxy, so SubBrute doesn’t send traffic to the domain’s name servers.

    It’s not an online tool, and you need to install this on your computer. You can use Windows or UNIX based OS, and installation is very easy. The following demonstration is based on CentOS/Linux.

    • Login into your CentOS/Linux
    • Download the latest SubBrute
    wget https://github.com/TheRook/subbrute/archive/master.zip .
    • Unzip the downloaded zip file
    unzip master.zip

    It will create a new folder called “subbrute-master”. Go inside the folder and execute the subbrute.py with the domain.

    ./subbrute.py yourdomain.com

    It will take few seconds and result in you with any subdomain found.

    Knock

    Knock is another python-based subdomain discovery tool that is tested with Python 2.7.6 version. It finds the subdomain of a target domain using a wordlist.

    • You can download and install this on Linux based OS.
    wget https://github.com/guelfoweb/knock/archive/knock3.zip .
    • Extract the downloaded zip file with unzip command
    unzip knock3.zip
    • it will extract and create a new folder “knock-knock3
    • Go inside this folder and install with the following command
    python setup.py install

    Once installed, you can scan for subdomains by following

    ./knockpy.py yourdomain.com

    DNSRecon on Kali Linux

    Kali Linux is an excellent platform for a security researcher, and you can use DNSRecon on Kali without installing anything.

    It checks all NS records for zone transfers, overall DNS records, wildcard resolution, PTR record, etc.

    To use DNSRecon, execute the following, and you are all done.

    dnsrecon –d yourdomain.com

    dnsrecon

    Pentest-Tools

    Pentest-tools search for subdomain using multiple methods like DNS zone transfer, DNS enumeration based on wordlist, and public search engine.

    You can save the output in PDF format.

    Conclusion

    I hope by using the above tools, you should be able to discover subdomains of the target domain for your security research. You may also want to try an online port scanner.

    If you are interested in learning ethical hacking, then check out this course.