I need to find most subdomains of a domain. I know there are many options.

I've tried many available in Kali Linux:


Most of them only find 2 or 3 working subdomains, while using this online tool, it finds many more.

Since pentest-tools require to buy credits in order to work, I'm trying to find a tool that would retrieve similar results like it. I haven't been successful so far.

My question is, how can I get best results from those tools, or what tool I'm missing?

  • 2
    have you confirmed that the domains the pentest-tool found are legitimate? – schroeder Feb 27 '18 at 17:43
  • Yes, most of them are. – Philippe Delteil Feb 27 '18 at 17:58
  • 3
    Have you manually walked the results they gave you in an attempt to reproduce it? If you can, download an old copy of Sam Spade and see what that turns up. Also, take a look at SSL certificates; see if any of them include multiple domains in the list. – John Deters Feb 27 '18 at 18:14

The tool you linked explained their techniques:

 DNS zone transfer
 DNS enumeration based on a specially chosen wordlist
 Public search engine queries
 Word mutation techniques

The Kali tools you mentioned can do some of those things, but perhaps not all. You might need to combine them or configure them differently.

Without knowing the specifics of what one tool found that another did not, it will be difficult to devise a more technical answer.

  • Hello, yes, I've noticed the explanation of the site's technique. I guess the most straightforward approach is to use most or all available recon tools and combine their results (and also add a way of testing the results in an automated way). – Philippe Delteil Mar 9 '18 at 17:13

Essentially, you need to look for zone cuts or authoritative NS records. A zone cut can be detected by checking the DNS response header for a NOERROR status when attempting a resolve a resource record of any type for that subdomain. An authoritative NS record can be found by asking a nameserver that the actual subdomain's zone lists (the parent domain might be able to answer, but that doesn't make it correct.) This presentation from the DNS Operations Analysis and Research Center elucidates.

I was able to demonstrate this by comparing the results between the answers to queries for recource records in websecurity.symantec.com. versus symantec.com. Notice how the nameserver authoritative for symantec.com. gives me the NS record for the websecurity.symantec.com. authoritative nameserver when I ask for its A record, even though an answer exists.

$ dig @ IN NS symantec.com. | head -1
symantec.com.           3596    IN      NS      pdns1.ultradns.net.
*$ dig @ IN NS websecurity.symantec.com. | head -1
websecurity.symantec.com. 542   IN      NS      k4.nstld.com.
$ dig @k4.nstld.com. IN A websecurity.symantec.com. | head -1
websecurity.symantec.com. 900   IN      A
*$ dig @pdns1.ultradns.net. IN A websecurity.symantec.com. | head -1
websecurity.symantec.com. 3600  IN      NS      j4.nstld.com.

You can use CTFR tool written by UnaPibaGeek on Github.

It's written in python and allows to get the subdomains from a HTTPS website in a few seconds by abusing Certificate Transparency logs. Visit Github link to know everything about it.

Before Installing

Make sure you have python (>= 3.0) and pip installed. To install pip type :

sudo apt-get install python3-pip


Do a `git clone of repo.

$ git clone https://github.com/UnaPibaGeek/ctfr.git

Go to that directory

$ cd ctfr

Do a pip3 install for requirements

$ pip3 install -r requirements.txt

Using CTFR

$ python3 ctfr.py -d starbucks.com

starbucks.com subdomains

$ python3 ctfr.py -d facebook.com -o /home/shei/subdomains_fb.txt

facebook subdomains

Please give the due credit to Sheila A. Berta.


Another (free) online tool is https://hackertarget.com/find-dns-host-records/ this provides one of the best sources I have seen.

Using starbucks.com as used in the example above reveals 149 records.

The records for this tool appear to be from a number of data sets including https://scans.io, commoncrawl and certificate transparency. So if you have lots of disk space and some time you could create your own database.

  • Welcome to Information Security Stack Exchange! Please note that if you are affiliated with this tool, you must disclose your affiliation. – S.L. Barth May 4 '18 at 8:13
  • 2
    Not affiliated but using it regularly for bounties. – joemorebugs May 4 '18 at 8:16
  • 1
    Welcome to the site! Thanks for the disclosure statement. One other thing: although the question asks for "tools" we try to avoid just flat out recommending tools unless the only tools are niche or specialised to address the question. You can imagine that a question like this could get a hundred people posting their favourite tool. Note that 2/3 of the other answers talk about techniques and not tools. – schroeder May 4 '18 at 9:20
  • Wow, this tool is amazing! Is really fast to retrieve results and I got over 50% more valid results than pentest-tools.com/information-gathering/…. It was only one test though. – Philippe Delteil May 5 '18 at 0:11
  • Check this one github.com/christophetd/censys-subdomain-finder – Philippe Delteil Jun 30 '18 at 5:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.