Eight subdomain enumeration tools that haven't been echoed a million times
Anyone who has ever explored web application security has likely used subdomain enumeration tools. When researching these tools, you'll often encounter recommendations for popular options such as DNS Dumpster or Sublist3r. While these tools and other popular options are excellent and part of my personal toolkit, they're not magic and can occasionally fail to enumerate subdomains. However, by utilizing some lesser known tools in combination with the ones you're most likely already familiar with, I've generally been able to compensate for the shortcomings of popular tools. In many situations, the lesser known tools I'll introduce in this blog outperform some of the more popular tools you might already be using. Some of the tools mentioned below offer paid versions, but I personally use the free version of each program and find them to be more than enough.
1. dnshistory.org
While dnshistory.org is predominantly a historical DNS record site, it also maintains records of subdomains, often ones not logged by any other resource. It has the added benefit of storing historical DNS records for each subdomain, enabling users to gather valuable insights. This website is by far one of the most underrated tools for both DNS enumeration and subdomain enumeration.
Price: Free
Registration: None
2. securitytrails.com
Similar to the first entry, Security Trails doesn't exclusively deal with subdomains and can be a useful resource for historical DNS records in addition to subdomain enumeration. While Security Trails generally has less comprehensive historical data compared to dnshistory.org, it performs well in subdomain enumeration, typically falling short only when dealing with older or less common subdomains in comparison to dnshistory.org.
Price: Free/Paid
Registration: Required
3. app.netlas.io
Netlas offers several search types, including searches by host/IP, IP and domain WHOIS, and certificate searches. The suite of tools provided by Netlas extends well beyond subdomain enumeration, and I highly recommend exploring its capabilities yourself. The only downside is the limited number of credits provided: unregistered users receive 10 credits every 10 hours, while registered users receive 50 credits per day. I've briefly mentioned Netlas's search features to stay within scope, but it offers many additional solutions valuable to both blue and red teams that are worth exploring.
Price: Free/Paid
Registration: Optional
4. cloud.projectdiscovery.io
Project Discovery provides a website enumeration and monitoring tool that not only enumerates subdomains but also logs the technologies used by the website, information about the website such as IP and ASN, details about the website's response to Project Discovery's requests, and takes screenshots of each enumerated web page. Project Discovery automatically checks the target sites weekly for changes, tracking new subdomains and updates to existing ones. To use this tool, you're required to register an account, but once registered, you can monitor up to 10 domains, each automatically scanned on a weekly basis.
Price: Free/Paid
Registration: Required
5. searchdns.netcraft.com
Netcraft's Search DNS tool allows you to query its extensive database of domains, making it highly useful for enumerating subdomains. You can filter search results by several criteria, including subdomain matches (URLs containing the subdomain anywhere) and URLs starting with, ending with, or containing specific text. Once a domain match is identified, another Netcraft tool can generate detailed site reports. While very effective, the site sometimes falls short in indexing smaller websites. However, if your target has a significant web presence or your scope is broad, Netcraft can be an extremely valuable asset.
Price: Free
Registration: None
6. nerdydata.com
Nerdy Data is a source code search engine that allows you to search its catalog of source code based on provided filters. Although Nerdy Data has various applications, in the context of subdomain enumeration, it is particularly effective for identifying domains sharing the same GTM tracking code (Google Analytics), enabling both subdomain and organization wide domain enumeration. Nerdy Data is free to use with optional registration and is especially valuable when mapping domains that appear unrelated yet belong to a single organization. Beyond subdomain enumeration, Nerdy Data provides many other filters and search functionalities that are worth exploring for additional use cases.
Price: Free/Paid
Registration: Optional
7. app.validin.com
Validin lets you query many categories of data including sub domains, certificate transparency (CT) logs, DNS records, and more. What sets Validin apart from its peers is the variety of identifiers you can search with, including IP addresses, domains, Google Tag Manager IDs (G-TAGs), CT hashes, and even entire CIDR blocks. Its data collection is impressive, especially the extensive sub-domain and CT log coverage.
On the free plan, however, you’re limited to 50 searches per month and no more than 10 per day. Like many similar services, Validin’s pricing climbs steeply between tiers the entry level paid plan costs $50 per month for 250 requests (maximum 50 per day), while the next tier jumps to $400 per month. An API is available, but lower-tier plans get only limited features.
Price: Free/Paid
Registration: Required
8. webscout.io
Web Scout offers a wide range of enumeration tools from basic domain information to discovering email addresses associated with a domain. It also lets you query specific categories directly, eliminating unnecessary data.
The free plan is quite limited at 100 requests per month, but it does include API access. Fortunately, Web Scout’s pricing model is reasonably affordable the entry-level paid plan costs $20 per month for 10,000 search credits (with a 2,000 search daily cap). If you need more, the next tier is $99 per month and offers 100,000 search credits with a daily limit of 10,000 searches
Price: Free/Paid
Registration: Required
Finding effective security tools can be a tedious, so I hope this post has made that task a little easier. Many of the tools mentioned here have additional capabilities beyond subdomain enumeration capabilities that I actively use but haven't discussed in depth in order to maintain the scope of this post. I strongly encourage you to explore each tool further on your own.
As I mentioned at the beginning of this article, the tools listed here aren't intended to replace those you currently use but rather to complement and enhance your existing toolkit. I hope you've discovered something new today. If you have any questions or comments, please feel free to reach out to me at [email protected].
Thanks for reading!