How to find all subdomains for a domain

dns

Have you ever wanted to discover all the subdomains for a given domain?

If you search on Google for tools that find all subdomains, you usually end up on sites with captchas and rate limits.

I discovered subfinder today.

subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.

You simply run subfinder -d <target domain>, and it spits out a list of the public subdomains it discovers.

Finding all subdomains can be useful for pen-testing and security hardening your network.


Like what you've read?

If you're an engineering leader or developer, you should subscribe to my 80/20 DevOps Newsletter. Give me 1 minute of your day, and I'll teach you essential DevOps skills. I cover topics like Kubernetes, AWS, Infrastructure as Code, and more.

Not sure yet? Check out the archive.

Unsubscribe at any time.