How to find all subdomains for a domain
Have you ever wanted to discover all the subdomains for a given domain?
If you search on Google for tools that find all subdomains, you usually end up on sites with captchas and rate limits.
I discovered subfinder today.
subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.
You simply run
subfinder -d <target domain>, and it spits out a list of the public subdomains it discovers.
Finding all subdomains can be useful for pen-testing and security hardening your network.
Like what you've read?
If you're an engineering leader or developer, you should subscribe to my 80/20 DevOps Newsletter. Give me 1 minute of your day, and I'll teach you essential DevOps skills. I cover topics like Kubernetes, AWS, Infrastructure as Code, and more.
Not sure yet? Check out the archive.
Unsubscribe at any time.