How to Find the Subdomains of a Domain | Geekflare (2024)

Subdomain finder is used to identify subdomains associated with a domain name for various purposes, such as security audits, SEO research, and penetration testing.

Subdomains are extensions of a domain name that allow website owners to create separate sections of their site for different purposes, such as a blog, online store, or support portal.

Hackers can use unmonitored subdomains to steal data and engage in malicious activities, potentially harming a website’s reputation. Monitoring all subdomains linked to a website is crucial to prevent these risks.

A subdomain finder can help uncover hidden web pages, test for vulnerabilities, and improve website performance. It is used by cybersecurity professionals, digital marketers, and website administrators.

Geekflare has researched and compiled the best domain finders based on ease of use, domain scoring, and comprehensive scanning capabilities.

  • WhoisXML Subdomain Lookup – Best for Developers
  • Criminal IP – Best for Domain Scoring
  • DNSDumpster – Best for Visualizing Subdomains
  • NMMapper – Best for Simple Online Lookups
  • Sublist3r – Best for Python Users
  • Netcraft – Best for Historical Subdomain Data
  • Knock Subdomain Scan – Best for Fast Permutation-Based Scans
  • DnsRecon – Best for Kali Linux DNS Recon
  • Pentest-Tools Subdomain Finder – Best for Pentesters
  • MassDNS – Best for Bulk Lookups
  • OWASP Amass – Best for Asset Discovery
  • Show moreShow less

You can trust Geekflare

Imagine the satisfaction of finding just what you needed. We understand that feeling, too, so we go to great lengths to evaluate freemium, subscribe to the premium plan if required, have a cup of coffee, and test the products to provide unbiased reviews! While we may earn affiliate commissions, our primary focus remains steadfast: delivering unbiased editorial insights, and in-depth reviews. See how we test.

WhoisXML Subdomain Lookup

Best for Developers

WhoisXML Subdomain Lookup is a part of the Domain Research Suite (DRS). It helps you discover a comprehensive list of subdomains associated with your main domain in just one click.

How to Find the Subdomains of a Domain | Geekflare (1)

With its extensive database that is updated daily, WhoisXML Subdomain Lookup offers up-to-date information about subdomains.

Subdomain records include three data points: subdomains, date first seen, and date last seen.

You can access subdomain intelligence through GUI tools, API calls, or batch feeds. When you use API, query results are in XML and JSON formats for easy integration.

WhoisXML Subdomain Lookup offers three payment plans, including a one-time purchase starting at $23, a monthly subscription starting at $19, and a yearly subscription starting at $190. It offers 500 DRS for free credit to try it. Each request costs one DRS credit.

Criminal IP

Best for Domain Scoring

Criminal IP is an open-source intelligence (OSINT) search engine that focuses on assessing attack surfaces and hunting for threats. Its domain research toolkit analyzes domain vulnerabilities and provides a score.

How to Find the Subdomains of a Domain | Geekflare (2)

The domain search feature of Criminal IP allows you to find all connected domains and subdomains, as well as tons of other security insights, including:

  • History of communication during page loading.
  • Technical stack used in a page
  • Information about certificates used on the page.
  • Inspection of connected IPs to discover malicious IPs

You have an option to export the report in the PDF format.

Criminal IP offers the following paid plans: Lite plan for $65 per month, Medium plan for $349 per month, Pro plan for $1089 per month, and Enterprise plan with a price available upon request. Criminal IP also offers a free plan that comes with domain search results limited to 3 pages.

DNSDumpster

Best for Visualizing Subdomains

DNSDumpster is a free domain research tool that provides information on domain host records, DNS records, and TXT records and offers a domain map feature. It is managed by hackertarget.com.

How to Find the Subdomains of a Domain | Geekflare (3)

The search utilizes data from various sources, such as search engines, web archives, security information databases, SSL certificate logs, and internet scans, to conduct a comprehensive search for hidden sub-domains and web hosts, enhancing vulnerability assessment and attack surface discovery.

NMMapper

Best for Simple Online Lookups

NMMapper is a useful tool for finding subdomains associated with your website. It utilizes eight popular subdomain finders to gather all hosts of your domain, making it an effective domain availability checker.

How to Find the Subdomains of a Domain | Geekflare (4)

And the best part is you can perform concurrent target scans on all these subdomain finders. This feature helps you compare and inspect results provided by these tools to get better insights into the subdomains associated with your main domain.

NMMapper also allows you toscan each of the subdomain names you have discovered to identify servers, technology, and DNS A records. If you runmultiple domains, itcan also help you visually inspect and compare which domain has the largest sub-domain.

NMMapper offers three pricing plans:

  • Standard- $5 per month with limited features
  • Premium- $10 per month with the ability to export records JSON/Excel
  • Professional- $15 per month with full API access and other advanced features

Sublist3r

Best for Python Users

Sublist3r is a powerful Python tool designed for subdomain enumeration using open-source intelligence (OSINT).

Well-suited for penetration testers, Python users, andbug hunters, Sublist3r finds subdomains using Ask, Baidu, Bing, Yahoo, Google, ReverseDNS, DNSDumpster, VirusTotal, and Netcraft.

How to Find the Subdomains of a Domain | Geekflare (5)

What’s more,the integration ofSublist3r with SubBrute enables you to discover more subdomains through brute forcing using an improved wordlist.Sublist3r is free to use.

Sublist3r can scan found subdomains against specific TCP ports. Moreover, you can enable verbose mode to display results in real-time. It also has an option to save the results toa textfile.

Sublist3r supports Python 2 and 3 and requires Python modules like requests,dnspython, andargparseto work.

Netcraft

Best for Historical Subdomain Data

Netcraft is a leading cybersecurity company offering a family of apps and extensions for email clients, browsers, and phones to enhance cybersecurity.

Netcraft offers a free tool to discover unmonitored subdomains linked with your main website. It is an easy-to-use tool; you just have to paste your website in the search box and press the enter button on your keyboard to see subdomains.

How to Find the Subdomains of a Domain | Geekflare (6)

However, Nercraft has a limitation. The search results will only show websites visited by Netcraft Extensions users at least five times in the last six months.

Netcraft’s SearchDNS tool is intuitive, and you will not encounter any difficulties using it. If you cannot use the tool optimally, explore the Search Tips section.

Knock Subdomain Scan

Best for Fast Permutation-Based Scans

Knock Subdomain Scan is a modular and portable Python3 tool designed for fast subdomain enumeration on the target domain using passive reconnaissance and dictionary scan.

With Knock Knock Subdomain Scan, you have the power to tailor your subdomain reconnaissance and brute-force attacks. You can leverage a range of customized options, including DNS servers, user agents, timeouts, and thread counts, to suit your specific needs.

How to Find the Subdomains of a Domain | Geekflare (7)

Knock Subdomain Scan can integrate with VirusTotal and Shodan for enhanced scanning capabilities by setting the respective API keys.

Knock Subdomain Scan supports JSON output and the report-saving feature for better data management. Guelfoweb developed the tool, which is in version 7.0.1. It is free and offers various installation options, including via pip or git.

DnsRecon

Best for Kali Linux DNS Recon

DnsRecon is a powerful Python tooldesignedto explore DNS functionalities and enhance network security assessments. Created as a Ruby script in 2007, it has since been rewritten in Python to extend its capabilities.

DnsRecon offersvarious features to perform comprehensive DNS checks. It can verify Name Server (NS) records for zone transfers and enumerate general DNS records such as Mail Exchange (MX), Start of Authority (SOA), NS, Address (A), AAAA, Sender Policy Framework (SPF), and Text (TXT) for a given domain.

How to Find the Subdomains of a Domain | Geekflare (8)

Additionally, it can perform common Service (SRV) record enumeration and expand top-level domains (TLDs).DNSRecon also includes functionality to check for wildcard resolutionand bruteforce subdomains and host A and AAAA records using a specified domain and wordlist. These insights can help you enhance your web security to prevent subdomain takeover attacks.

DnsRecon can perform Pointer (PTR) record lookups forgivenIP ranges or Classless Inter-Domain Routing (CIDR), making it valuable for network mapping andreconnaissance. It can also check DNS server cached records for A, AAAA, and CNAME records using a list of host records provided in a text file.

To use DnsRecon, you need Python 3.6 or newer, which ensures compatibility with modern Python environments. It is a free tool that comes preinstalled on Kali.

Pentest-Tools Subdomain Finder

Best for Pentesters

Pentest-Tools Subdomain Finder helps you identify subdomains of an internet domain to understand your organization’s attack surface. It combines multiple discovery methods to return valid results for extensive reconnaissance.

Subdomain Finder validates each scan result, providing IP addresses, WHOIS details, server information, and more.

How to Find the Subdomains of a Domain | Geekflare (9)

It identifies subdomains behind firewalls and supports wide-scope engagements, which makes it essential for vulnerability scanning and ethical hacking.

Subdomain Finder offers various tools for security scanning, including vulnerability scanning, WAF detection, and port scanning. It has both free and paid plans, with the paid plans offering access to 20+ security tools and features. The free plan allows for basic subdomain extraction, while the paid plan offers deeper scans and customizable options.

Here is the pricing plan for Pentest-Tools:

PlanPricingNumber of AssetsParallel Scan
Basic$84/month52
Advanced$190/month505
Teams$395/month50010

It also offers a free plan that allows you to scan up to 5 assets and run 2 parallel scans with limited features.

MassDNS

Best for Bulk Lookups

MassDNS is a high-performance DNS stub resolver that can resolve millions or billions of domain names. It can handle over 350,000 names per second with public resolvers without any particular configuration.

How to Find the Subdomains of a Domain | Geekflare (10)

MassDNS supports various options for DNS queries, including custom resolver files and output formats to offer data from your chosen listof domain names. It also includes scripts for advanced tasks like subdomain brute-forcing and extracting data from certificate transparency logs.

Ideal for users who need to process a vast amount of domain names efficiently, MassDNS offers a simple yet powerful solution for large-scale DNS resolution tasks.

MassDNS is free to use. However, to use the tool optimally, you need some technical know-how.

OWASP Amass

Best for Asset Discovery

OWASP Amass is ideal for security researchers due to its ability to perform thorough network mapping of attack surfaces and external asset discovery.

OWASP Amass uses open-source intelligence gathering and reconnaissance techniques to find subdomains associated with a domain, and it is free to use.

How to Find the Subdomains of a Domain | Geekflare (11)

The OWASP Amass framework comes with:

  • A collection engine for asset discovery
  • An asset database for storage of findings
  • The Open Asset Model

For DNS-related search queries, OWASP Amass uses Brute forcing, Reverse DNS sweeping, NSEC zone walking, Zone transfers, Fully Qualified Domain Name (FQDN) alterations/permutations, and FQDN similarity-based Guessing to provide results.

If you use a fully functional Kali Linux, OWASP Amass is already there. Go to “Application,” search for Amass, and click on it to run.

Benefits of a Subdomain Finder Tool

A subdomain finder tool is critical for efficient domain management and security, as it uncovers hidden subdomains and provides you with valuable insights.

Here are the key benefits a subdomain finder tool offers:

  • Enhancing Security: By identifying hidden subdomains, a subdomain finder tool can help strengthen your website’s security defenses.
  • Comprehensive Reconnaissance: Mapping out domains using a subdomain finder tool enables you to conduct thorough research and analysis.
  • Time-Saving Automation: Automating the process of discovering subdomains with a finder tool helps save valuable time and resources.
  • Prioritizing Vulnerability Scans: A subdomain finder tool can assist in determining which subdomains should be prioritized for vulnerability scans to prevent potential security breaches.
  • Improving Incident Response: By uncovering unauthorized subdomains, a finder tool can enhance your incident response strategies and prevent potential threats.
  • Brand Protection: Detecting rogue subdomains with a finder tool can safeguard your brand reputation and prevent any unauthorized usage.
  • Detailed Information: Subdomain finder tools provide in-depth information such as IP addresses and WHOIS details, allowing you to assess and manage your domains effectively.

Use Cases of a Subdomain Finder Tool

Subdomain finders are essential tools in cybersecurity and IT management, offering a range of applications.

Here are some common use cases where subdomain search tools prove to be invaluable:

  • Identify all subdomains for comprehensive security audits and discover hidden vulnerabilities
  • Conduct thoroughreconnaissanceto mapoutthe attack surface and test subdomains for security weaknesses.
  • Locate subdomains to uncover hidden vulnerabilities and increase the chances of finding exploitable issues.
  • Continuously monitor subdomains for new vulnerabilities and prioritize them based on risk level.
  • Investigate subdomains to understand the scope of security incidents and identify unauthorized subdomains.
  • Detect and manage subdomains to prevent misuse and impersonation and protect brand reputation.
  • Ensure all subdomains comply with security policies and generate reports for audits and regulatory requirements.

Metasploit, Nmap, and Burp Suite are popular penetration tools. These pentest tools help identify vulnerabilities and ensure robust security measures.

#1. Metasploit

Metasploit is a widely used penetration tool created by the open-source community and Rapid7. It comes in two versions, Metasploit Framework (free) and Metasploit Pro (paid), and is based on the use of modules to perform specific functions in penetration testing.

#2. Nmap

Nmap is a free, open-source network scanning tool used for network discovery and security auditing. It helps identify available network hosts, services, operating systems, packet filters/firewalls, and other network characteristics.

#3. Burp Suite Professional

Burp Suite Professional is an advanced web vulnerability scanner that helps with manual testing, automatic discovery, and fixing security issues in web applications.

Related Articles

  • Best Domain Blacklist Checker Tools
  • Best Domain Name Search Tools
How to Find the Subdomains of a Domain | Geekflare (2024)

FAQs

What is the Google command to find the subdomains of a website? ›

Find Subdomains Using Google

Using Google's "site:" filter, we can see some of the subdomains Google has discovered for a site. We can then add the "-inurl:" filter to exclude the subdomains we've already found, allowing us to see more.

What search phrase can be used to find subdomains of a website? ›

By search engines

These operators are often referred to as Google Dorks. We can use site: operator in Google search to find all the Subdomains that Google has found for a Domain. Lets take an example on “site:vulnweb.com”.

How many subdomains does a domain have? ›

Characteristics and Parameters of a Subdomain

A domain can have up to 500 subdomains. You can create multiple levels of subdomains such as store.product.yoursite.com, test.forum.yoursite.com, etc. Each subdomain can be up to 255 characters long, but for multi level subdomains, each level can only be 63 characters long.

Do subdomains count for SEO? ›

As long as you use them correctly, subdomains are fine for your SEO performance.

Do subdomains affect main domain? ›

Your subdomain reputation(s) can impact base domain reputation, but the impact between subdomains will be small. Subdomains are not a way to avoid a bad domain reputation. Instead, they will help differentiate your traffic while maintaining a clear relationship with your main domain.

How do I find all the subsites of a website? ›

You can usually locate it in the root or footer section of the website. For example, the XML sitemap URL could be “www.example.com/sitemap.xml“. Once you click on the sitemap, you will find all pages & subpages of a website. You can use different sitemap generation tools if you don't have an existing sitemap.

Do subdomains show up on Google search? ›

The short answer is yes, Google can and will index and rank subdomains unless you explicitly take steps to ensure they're excluded from its index. Google's entire business model is based on discovering content. The same goes for all search engines.

What is subdomain lookup? ›

A Subdomain Finder is a subdomain enumeration tool that helps you discover subdomain hosts (aka subdomain FQDNs) which serve specific functions for your target (e.g. hosting public websites, private subdomains for testing web apps, URLs where you can find backups, etc.).

Does Google Search Console include subdomains? ›

Domain properties show data for all URLs under the domain name, including all protocols, subdomains, and paths. They give you a complete view of your website across Search Console, reducing the need to manually combine data.

Is it possible to list all subdomains? ›

You should be able to sort your list of DNS records by 'Name' and thereby get a list of all the subdomains (subdomains will be everything that isn't @). You can also sort by 'Type' and look only at those with the CNAME type if you want to exclude TXT records and MX records.

What does a subdomain URL look like? ›

While a subdomain will appear before your TLD, a subdirectory link will include the subdirectory name after the original TLD. For example: Subdomain example: mysubdomain.mywebsite.com. Subdirectory example: mywebsite.com/mysubdirectory.

How many subdomains does Google domain have? ›

Up to 100 subdomains allowed: When you register a domain name with Google Domains, you receive access to up to 100 subdomains.

Are subdomains included with the domain? ›

Subdomains are used to expand the use of a single domain, these do not need to be purchased separately to your domain; if you own a domain then you can add a subdomain to this. This method is commonly used for Moodle and Totara site setups.

Can I list my domain on multiple sites? ›

One domain can be mapped to only one website at any given time. But different domains can point to the same website. If you buy a domain name of your own, you can add any number of subdomains you want, and have them point to different websites.

Top Articles
Latest Posts
Article information

Author: Horacio Brakus JD

Last Updated:

Views: 5312

Rating: 4 / 5 (51 voted)

Reviews: 82% of readers found this page helpful

Author information

Name: Horacio Brakus JD

Birthday: 1999-08-21

Address: Apt. 524 43384 Minnie Prairie, South Edda, MA 62804

Phone: +5931039998219

Job: Sales Strategist

Hobby: Sculling, Kitesurfing, Orienteering, Painting, Computer programming, Creative writing, Scuba diving

Introduction: My name is Horacio Brakus JD, I am a lively, splendid, jolly, vivacious, vast, cheerful, agreeable person who loves writing and wants to share my knowledge and understanding with you.