Other than testing different URLs separately, is there anyway to find out if a website has a wildcard sub domain?
The first answer doesn't technically answer the question.
There's only one official method of doing this using the
dig @ns.thenameserver.net example.com axfr
AXFR is a method of domain transfer and if the nameservers are configured to allow the command to be executed then it would give you the full NS record for that domain including any subdomains.
However you are likely to get the following message:
; <<>> DiG 9.8.3-P1 <<>> @ns.thenameserver.net example.com axfr ; (1 server found) ;; global options: +cmd ; Transfer failed.
This is for security reasons.
- SubBrute Python Script (https://github.com/TheRook/subbrute) - a Python script that uses a dictionary to brute force lookup subdomains for a given domain.
- Fierce2 Perl Script (http://ha.ckers.org/fierce/) - similar to SubBrute but with a smaller dictionary and anecdotally lower. Still worth a look.
- Google with the following query
site: example.com. This may or may not retrieve subdomains of the main domain
- This website helps you use of a number of methods: https://pentest-tools.com/reconnaissance/find-subdomains-of-domain
In this answer, you can detect from DNS if they have a wildcard domain, this will save you time (and you won't have HTTP queries to the domain)
Taken from the serverfault post:
# dig +short '*.not-a-real-domain.com' 126.96.36.199