Find a website's subdomains
Subdomains expose what an organisation did not mean to publish: staging, admin interfaces, old projects. The most productive source is not scanning but certificate logs, which record every hostname that received a TLS certificate.
The tools, in order
- 01
Queries certificate transparency logs, the richest source
CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.
- 02DNS Dumpsterfree
Maps DNS records and associated hosts
Free domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.
- 03SecurityTrailsfreemium
Adds history, revealing hosts that are now hidden
Comprehensive DNS and domain intelligence platform. Access historical DNS records, WHOIS data, IP neighbors, subdomain enumeration and attack surface data for any domain.
- 04RapidDNSfree
Fast subdomain lookup by parent domain
Fast subdomain and reverse DNS lookup tool. Enumerate subdomains, find domains sharing an IP, discover certificate transparency data and perform bulk DNS queries.
- 05Amass (T)free
Exhaustive enumeration combining dozens of sources
Advanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.
- 06Subfinder (T)free
Fast passive enumeration, ideal as a first pass
Fast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.
The pitfall to avoid
Reading a public index is passive and lawful. Actively scanning infrastructure you do not own is penetration testing and requires written authorisation.
🧭 The full plan
The copilot orders every step from your starting point, with pre-filled queries.
📖 The guides
Detailed methods by investigation type.