How to find all subdomains for a domain

dns

Have you ever wanted to discover all the subdomains for a given domain?

If you search on Google for tools that find all subdomains, you usually end up on sites with captchas and rate limits.

I discovered subfinder today.

subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.

You simply run subfinder -d <target domain>, and it spits out a list of the public subdomains it discovers.

Finding all subdomains can be useful for pen-testing and security hardening your network.

Master GitHub Actions with a Senior Infrastructure Engineer

As a senior staff infrastructure engineer, I share exclusive, behind-the-scenes insights that you won't find anywhere else. Get the strategies and techniques I've used to save companies $500k in CI costs and transform teams with GitOps best practices—delivered straight to your inbox.

Not sure yet? Check out the archive.

Unsubscribe at any time.