Subdomain scanners


Subdomain scanners are typically used for reconnaissance.

Users for these tools include pentesters.


Popular subdomain scanners

SubFinder (subdomain scanner)

discovery of sensitive information, information gathering, penetration testing, reconnaissance, security assessment

SubFinder is a tool to scan domains and discover subdomains. This may be useful during the reconnaissance phase of penetration testing where information is collected. Some subdomains may reveal sensitive data or point to interesting targets such as a backup location.

SubOver (subdomain takeover tool)

security assessment

SubOver is considered a hostile tool to take over a subdomain. It can be used during pentesting and security assessments to discover unconfigured subdomains.

Sublist3r (subdomains enumeration tool)

Sublist3r helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.

Th3inspector (extensive information gathering tool)

discovery of sensitive information, information gathering

This tool can be called a true 'inspector tool' as it helps to discover many types of data.

  • Website information
  • Domain and subdomain information
  • Mail server information and email
  • Phone details
  • IP addresses
  • Detection of used CMS

altdns (subdomain discovery tool)

reconnaissance, subdomain discovery, subdomain enumeration

Altdns is a security tool to discover subdomains. It generates permutations, alterations, and mutations of subdomains. The generated names can also be tested by performing DNS lookups. An enumeration tool like Altdns is useful during penetrating testing assignments.

domain (setup script for Recon-ng and altdns)

subdomain enumeration

Domain is a Python script written by Jason Haddix to combine the tools Recon-ng and altdns. It allows to use the two tool one multiple domains within the same session.

subDomainsBrute (subdomain scanning tool for pentesters)

The subDomainsBrute tool is one of the tools to perform a scan on a domain to discover subdomains and store the output.

Missing a favorite tool in this list? Share a tool suggestion and we will review it.

Related topics

Looking for more specific topics within this tool group? Have a look at the following relevant topics.