Subdomain Enumeration

Subfinder

Go

Featured

Fast passive subdomain enumeration tool. Uses multiple sources including certificate transparency logs.

Amass

Go

Featured

In-depth attack surface mapping and asset discovery. DNS enumeration, network mapping, OSINT data sources.

dnsx

Go

Fast multi-purpose DNS toolkit. Retries, wildcard filtering, and multiple resolver support.

Knock

Python

Subdomain enumeration tool using wordlist and DNS resolution. Supports VirusTotal and zone transfers.

Assetfinder

Go

Find domains and subdomains potentially related to a given domain. Pulls from multiple passive sources.

Subjack

Go

Subdomain takeover tool. Checks if CNAME records point to deprovisioned cloud services.

Altdns

Python

Subdomain discovery through alterations and permutations. Generates mutated wordlists from known subdomains.

DNSRecon

Python

DNS enumeration script. Zone transfers, reverse lookups, Google dorking, SRV records, and DNSSEC testing.

GoBuster DNS

Go

DNS subdomain bruting using Go. Concurrent queries with wildcard detection and custom resolvers.

DNSenum

Perl

Multithreaded DNS enumeration tool that discovers subdomains via dictionary brute-force, Google scraping, and zone transfers.

shuffleDNS

Go

Wrapper around massdns for enumerating valid subdomains using active bruteforce and resolving with wildcard filtering.

puredns

Go

Fast domain resolver and subdomain bruteforcing tool that handles wildcard detection and DNS validation.

Findomain

Rust

Cross-platform subdomain enumerator using certificate transparency logs and multiple APIs for fast passive discovery.

Sublist3r

Python

Fast subdomain enumeration tool using OSINT sources for penetration testers.