Finding subdomains

From Archiveteam
Revision as of 13:32, 2 August 2023 by PaulWise (talk | contribs) (reference the Discovery and Site exploration pages, otherwise the removed methods will be lost to users of this page)
Jump to navigation Jump to search

There are several ways to attempt to find subdomains for a given domain.

  1. The methods listed on Discovery and Site exploration
  2. Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available.
  3. Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list
  4. Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html
  5. https://osint.sh/subdomain/
  6. Certificate transparency logs https://crt.sh/
  7. Software options:
    1. Subfinder, which includes several of the above methods https://github.com/projectdiscovery/subfinder
    2. Knockpy https://github.com/guelfoweb/knock
    3. dnsenum2 https://github.com/SparrowOchon/dnsenum2
    4. dnsmap https://github.com/resurrecting-open-source-projects/dnsmap
    5. gobuster https://github.com/OJ/gobuster
  8. Twitter search
  9. Additional methods: https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6
Retrieved from "https://wiki.archiveteam.org/index.php?title=Finding_subdomains&oldid=50339"