Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of the things I need to do from time to time is to find subdomains of a site for example.

Starting with example.com

  • sub1.example.com
  • other.example.com
  • another.example.com

I'm looking for any additional ways to perform recon on these targets and I want to get a list of all the subdomains of a domain.

I'm currently doing a number of things inlcuding

  • using maltego to crawl for info
  • Using search engines to search for subdomains
  • crawling site links
  • Examining DNS records
  • Examining incorrectly configured SSL certificates
  • Guessing things like 'vpn.example.com'

I reckon there are more than the ones i've found so far, but now I'm out of ideas.

share|improve this question
There is another post on stackoverflow that's quite good: [List of Subdomains][1] [1]: stackoverflow.com/questions/131989/… –  Dr.Ü Apr 30 '13 at 6:58
Unfortunately It didn't work out. The wolfram alpha tool was promising, but didn't work any more sadly. AXFR requests aren't allowed either which seems to be what most of the other subbies are.. –  NULLZ Apr 30 '13 at 7:06
I would try it with knock (code.google.com/p/knock) but watch out: there is a risk of being blacklisted. –  Dr.Ü Apr 30 '13 at 7:19
There's a python script called subdomainer.py that should be able to help you out... Have a search on google –  AndyMac Apr 30 '13 at 7:38
FYI it can be found on the edge-security.com website, but the old link posted on SecurityTube wiki page is dead (albeit it does have usage example which is of course defined in usage() anyway). Judging by source code, what it does is it collates data from three major search engines (yahoo, msn, google) and to me obscure website pgp.rediris.es that seems to be an email scrapper. –  TildalWave Apr 30 '13 at 7:57

3 Answers 3

up vote 5 down vote accepted

As a pentester being able to find the subdomains for a site comes up often. So I wrote a tool, SubBrute that does this quite well if I do say so my self. In short, this is better than other tools (fierce2) in that its a lot faster, more accurate and easier to work with. This tool comes with a list of real subdomains obtained from spidering the web. This subdomain list is more than 16 times the size of fierce2 and subbrute will take about 15 minutes to exhaust this list on a home connection. The output is a clean newline separated list, that is easy to use as the input for other tools like nmap or a web application vulnerability scanner.

share|improve this answer
Awesome, i'll check it out. Any idea how well it compares to 'knock'? –  NULLZ May 5 '13 at 6:00
@D3C4FF knock is crap. –  rook May 5 '13 at 19:32
All glory be to Rook. I used the tool in a live test today and it worked like a charm. It only missed one out of two dozen sub domains which was named mywebreading –  NULLZ May 9 '13 at 6:46
@D3C4FF hell yeah, I'm glad it did the trick ;) –  rook May 9 '13 at 6:52
@Rook just a quick idea regarding subbrute, add the option to resolve (and print out) the IP address from the found hostnames as well. I made that change and it helped with a few tests where certain ranges were out of scope even though they were subdomains. Thanks again! –  NULLZ Nov 26 '13 at 22:26

I would try it with knock (code.google.com/p/knock) but watch out: there is a risk of being blacklisted.

Unfortunately is there no way around bruteforcing if a zone transfer doesn't work.

share|improve this answer
This tool is low quality; SubBrute is a lot better. –  rook May 5 '13 at 19:32
Thanks, i'll give it a try... –  Dr.Ü May 6 '13 at 7:26

Take a look at http://ha.ckers.org/fierce/. It can take a dictionary file as well as brute force. It is included in Kali as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.