How to find subdomains of a domain

Question

For a security project, I need to enumerate subdomains of a given domain to identify potential entry points. Are there reliable tools or techniques that can be used to discover subdomains efficiently, and what are the typical steps for conducting this type of scan?

Any tips on popular tools or automated methods for subdomain enumeration would be helpful.

Answer 1

To enumerate subdomains of a domain, there are several reliable techniques and tools commonly used in security assessments.

1. Using DNS Reconnaissance Tools

Sublist3r: A popular tool for enumerating subdomains using various search engines.

sublist3r -d example.com

Amass: A powerful tool that uses active and passive methods to find subdomains.

amass enum -d example.com

Assetfinder: Quickly finds related domains and subdomains.

assetfinder --subs-only example.com

2. Using Online Services

• VirusTotal: VirusTotal has a "subdomains" feature that lists all subdomains found for a domain.
• crt.sh: Search for SSL certificates issued for subdomains of the target domain.
• SecurityTrails and Spyse: Both provide extensive subdomain data and API access.

3. DNS Brute-Forcing

dnsrecon: Can brute-force possible subdomains.

dnsrecon -d example.com -D subdomains.txt -t brt

Gobuster: Useful for brute-forcing subdomains with a wordlist.

gobuster dns -d example.com -w subdomains.txt

4. Using Passive DNS Services

Passive DNS services like DNSDumpster and PassiveTotal aggregate historical DNS data, which is valuable for discovering subdomains without triggering detection.