Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of the things I need to do from time to time is to find subdomains of a site for example.

Starting with


I'm looking for any additional ways to perform recon on these targets and I want to get a list of all the subdomains of a domain.

I'm currently doing a number of things inlcuding

  • using maltego to crawl for info
  • Using search engines to search for subdomains
  • crawling site links
  • Examining DNS records
  • Examining incorrectly configured SSL certificates
  • Guessing things like ''

I reckon there are more than the ones i've found so far, but now I'm out of ideas.

share|improve this question
There is another post on stackoverflow that's quite good: [List of Subdomains][1] [1]:… – Dr.Ü Apr 30 '13 at 6:58
Unfortunately It didn't work out. The wolfram alpha tool was promising, but didn't work any more sadly. AXFR requests aren't allowed either which seems to be what most of the other subbies are.. – NULLZ Apr 30 '13 at 7:06
I would try it with knock ( but watch out: there is a risk of being blacklisted. – Dr.Ü Apr 30 '13 at 7:19
There's a python script called that should be able to help you out... Have a search on google – AndyMac Apr 30 '13 at 7:38
FYI it can be found on the website, but the old link posted on SecurityTube wiki page is dead (albeit it does have usage example which is of course defined in usage() anyway). Judging by source code, what it does is it collates data from three major search engines (yahoo, msn, google) and to me obscure website that seems to be an email scrapper. – TildalWave Apr 30 '13 at 7:57
up vote 17 down vote accepted

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. This subdomain list is more than 16 times the size of fierce2 and subbrute will take about 15 minutes to exhaust this list on a home connection. The output is a clean newline separated list, that is easy to use as the input for other tools like nmap or a web application vulnerability scanner.

share|improve this answer
Awesome, i'll check it out. Any idea how well it compares to 'knock'? – NULLZ May 5 '13 at 6:00
@D3C4FF knock is crap. – rook May 5 '13 at 19:32
All glory be to Rook. I used the tool in a live test today and it worked like a charm. It only missed one out of two dozen sub domains which was named mywebreading – NULLZ May 9 '13 at 6:46
@D3C4FF hell yeah, I'm glad it did the trick ;) – rook May 9 '13 at 6:52
@Rook just a quick idea regarding subbrute, add the option to resolve (and print out) the IP address from the found hostnames as well. I made that change and it helped with a few tests where certain ranges were out of scope even though they were subdomains. Thanks again! – NULLZ Nov 26 '13 at 22:26

I would try it with knock ( but watch out: there is a risk of being blacklisted.

Unfortunately is there no way around bruteforcing if a zone transfer doesn't work.

share|improve this answer
This tool is low quality; SubBrute is a lot better. – rook May 5 '13 at 19:32
Thanks, i'll give it a try... – Dr.Ü May 6 '13 at 7:26

Jason Haddix wrote my favorite subdomain/hostname discovery tool that depends on a very-recent version of recon-ng -- available here --

subbrute is decent, fierce -dns <domain> works great, dnsmap <domain> -r file.txt is also valid, and I don't see any reason to dislike knock -wc <domain> (although the other features of knock may be suspect). All of these tools use techniques that are showing their age, however. The trick for some of these attack improvements is to come up with a customized file with hostnames that are geared specifically for the target.

However, the chainsaw for DNS discovery is dnsrecon. It does everything.

You might also consider a commercial offering, such as RiskIQ, which can do quite a lot more than all of these tools. Their techniques include a lot of surveying that most of you would not think of.

[UPDATE] Another favorite (for hostnames, not primarily subdomains -- is the OP interested in both?) is --

share|improve this answer

Take a look at It can take a dictionary file as well as brute force. It is included in Kali as well.

share|improve this answer

Easy. Write site address to wolframalpha. And click "subdomins" button.

An Example;

Click "Subdomains" for view subdomains of the site.

Also, wolfram alpha has api if you want to reach and use it. Hope it helps...

share|improve this answer
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. – M'vy Apr 10 '15 at 13:55
Lost - if you can expand on this, by explaining what Wolfram does, this answer may get upvotes. – Rory Alsop Apr 10 '15 at 17:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.