How to find Subdomains of a Domain in Minutes? (2024)

Discovering subdomains of a domain is an essential part of hacking reconnaissance, and thanks to following online tools, which make life easier.

Having an unsecured subdomain can lead to a serious risk to your business, and lately, there have been some security incidents where the hacker used subdomain tricks.

The most recent one was Vine, where the entire code was available to download from a vulnerably exposed subdomain.

If you are a website owner or security researcher, you can use the following tools to find the subdomains of any domain.

Fast and Accurate Subdomain Finder Tools

WhoisXML API Subdomain Lookup

WhoisXML API Subdomain Lookup tools allow users to discover a domain name’s subdomains easily. The subdomains product line is fueled by a comprehensive repository that includes 2.3+ billion subdomain records with 1+ million subdomains added daily.

How to find Subdomains of a Domain in Minutes? (1)

The tools allow researching any target domain name and reveal the list of all subdomains found for the domain with timestamps of the first time the record was seen and the last update for a specific record.

The product line includes a/an:

  • API with output queries in XML and JSON formats for easy integration
  • Data feed with files available in unified and consistent CSV format updated both on a daily and weekly basis. Download the CSV sample to test the data in your environment
  • GUI lookup tool that creates reports with shareable links

Check this product sheet to learn how WhoisXML API’s subdomain data can match specific data requirements.

Criminal IP

Criminal IP is a Cyber Threat Intelligence (CTI) search engine that offers a range of features to simplify the process of searching for domains and IT assets.

Through the Domain Search feature, you can effortlessly retrieve detailed information about a specific domain, including both the connected domains and subdomains.

How to find Subdomains of a Domain in Minutes? (2)

Simply enter the domain name, and you will gain access to all the essential details you need. The insights provided by Domain Search Criminal IP extend beyond the connected domains and subdomains. Additionally, you will gain access to crucial information like this:

  • Page Redirections (Provides the pages redirected from a specific domain)
  • Connected IP Info (Provides the safety status of the IP address connected to that domain)
  • Cookies (Provides the information regarding the cookies collected by a domain)
  • Technologies used by a website.
  • Phishing Record, Suspicious HTML Element, Suspicious Program, Suspicious Favicon, and many more.

Criminal IP offers a free plan and various options for paid plans. You can choose the plan that is most suitable for you.

DNS Dumpster

DNSDumpster is a domain research tool to find host-related information. It’s the HackerTarget.com project.

How to find Subdomains of a Domain in Minutes? (3)

Not just a subdomain, but it gives you information about the DNS server, MX record, TXT record, and excellent mapping of your domain.

NMMAPPER

An online tool to find subdomains using Anubis, Amass, DNScan, Sublist3r, Lepus, Censys, etc.

How to find Subdomains of a Domain in Minutes? (4)

I tried NMMAPPER for one of the domains, and the results were accurate. Go ahead and give it a try for your research work.

Sublist3r

Sublist3r is a Python tool to find subdomains using a search engine. Currently, it supports Google, Yahoo, Bing, Baidu, Ask, Netcraft, Virustotal, ThreatCrowd, DNSdumpster, and PassiveDNS.

Sublist3r is supported only on the Python 2.7 version and has few dependencies in a library.

You can use this tool on Windows, CentOS, Rehat, Ubuntu, Debian, or any other UNIX-based OS. The following example is from CentOS/Linux.

  • Login to your Linux server
  • Download latest Sublist3r
wget https://github.com/aboul3la/Sublist3r/archive/master.zip .

Extract the downloaded file

unzip master.zip
  • It will create a new folder called “Sublist3r-master”

As I mentioned earlier, it has the following dependencies, and you can install it using a yum command.

yum install python-requests python-argparse

Now you are set to discover the subdomain by using the following command.

./sublist3r.py -d yourdomain.com
How to find Subdomains of a Domain in Minutes? (5)

As you can see, it did discover my subdomains.

Netcraft

Netcraft has a large number of domain databases, and you don’t want to miss this in finding public subdomain information.

How to find Subdomains of a Domain in Minutes? (6)

The search result will contain all the domains and subdomains with first seen, netblock, and OS information.

If you need more information about the website, click on-site report, and you will be given tons of information about technologies, ranking, etc.

How to find Subdomains of a Domain in Minutes? (7)

Detectify

How to find Subdomains of a Domain in Minutes? (8)

Detectify can scan subdomains against hundreds of pre-defined words, but you can’t do this to a domain you don’t own.

However, if you have authorized a user, you can enable subdomain discovery in the overview under settings.

SubBrute

SubBrute is one of the most popular and accurate subdomain enumeration tools. It’s a community-driven project, and it uses the open resolver as a proxy, so SubBrute doesn’t send traffic to the domain’s name servers.

It’s not an online tool, and you need to install this on your computer. You can use Windows or UNIX-based OS, and installation is very easy. The following demonstration is based on CentOS/Linux.

  • Log in to your CentOS/Linux
  • Download the latest SubBrute
wget https://github.com/TheRook/subbrute/archive/master.zip .
  • Unzip the downloaded zip file
unzip master.zip

It will create a new folder called “subbrute-master”. Go inside the folder and execute the subbrute.py with the domain.

./subbrute.py yourdomain.com

It will take a few seconds and result in you with any subdomain found.

Knock

Knock is another Python-based subdomain discovery tool tested with the Python 2.7.6 version. It finds the subdomain of a target domain using a wordlist.

  • You can download and install this on a Linux-based OS.
wget https://github.com/guelfoweb/knock/archive/knock3.zip .
  • Extract the downloaded zip file with the unzip command
unzip knock3.zip
  • it will extract and create a new folder, “knock-knock3.
  • Go inside this folder and install it with the following command
python setup.py install

Once installed, you can scan for subdomains by following

./knockpy.py yourdomain.com

DNSRecon on Kali Linux

Kali Linux is an excellent platform for a security researcher, and you can use DNSRecon on Kali without installing anything.

It checks all NS records for zone transfers, overall DNS records, wildcard resolution, PTR records, etc.

To use DNSRecon, execute the following, and you are all done.

dnsrecon –d yourdomain.com
How to find Subdomains of a Domain in Minutes? (9)

Pentest tools search for subdomains using multiple methods like DNS zone transfer, DNS enumeration based on wordlist, and public search engines.

How to find Subdomains of a Domain in Minutes? (10)

You can save the output in PDF format.

MassDNS

If you want to resolve domain names in bulk, MassDNS is the tool for you. This tool can resolve over 350,000 domain names per second! It uses publicly available resolvers, and it is suited for people who want to resolve millions or even billions of domain names.

How to find Subdomains of a Domain in Minutes? (11)

One issue you may face while using this tool is that it may increase the load on public resolvers and lead to your IP address being flagged for abuse. Therefore, this tool must be used with caution.

OWASP Amass

Amass has been created to help information security professionals perform network mapping of attack surfaces and perform external asset discovery.

The tool is entirely free to use, and its clientele includes the leading IT company Accenture.

Final Words

By using the above tools, I hope you will be able to discover subdomains of the target domain for your security research.

Related Articles

  • Best Platforms to Sell Domain Names
  • Domain Propagation and Tools Explained
  • Free Email Hosting on Custom Domain
  • Tools to Check Domain Blacklists

You can trust Geekflare

Imagine the satisfaction of finding just what you needed. We understand that feeling, too, so we go to great lengths to evaluate freemium, subscribe to the premium plan if required, have a cup of coffee, and test the products toprovide unbiased reviews! While we may earn affiliate commissions, our primary focus remains steadfast: delivering unbiased editorial insights, and in-depth reviews. See how we test.

How to find Subdomains of a Domain in Minutes? (2024)
Top Articles
Latest Posts
Article information

Author: Kerri Lueilwitz

Last Updated:

Views: 6058

Rating: 4.7 / 5 (47 voted)

Reviews: 86% of readers found this page helpful

Author information

Name: Kerri Lueilwitz

Birthday: 1992-10-31

Address: Suite 878 3699 Chantelle Roads, Colebury, NC 68599

Phone: +6111989609516

Job: Chief Farming Manager

Hobby: Mycology, Stone skipping, Dowsing, Whittling, Taxidermy, Sand art, Roller skating

Introduction: My name is Kerri Lueilwitz, I am a courageous, gentle, quaint, thankful, outstanding, brave, vast person who loves writing and wants to share my knowledge and understanding with you.