Best Subdomain Enumeration Tools in 2026 — Online & Self-Hosted
A complete, honest comparison of every meaningful subdomain enumeration tool available in 2026 — from browser-based tools that need no installation to heavyweight CLI frameworks used in professional red team engagements. Covers SubDomainsFinder, Subfinder, OWASP Amass, Sublist3r, Findomain, DNSDumpster, crt.sh, SecurityTrails, Assetfinder, theHarvester, Shodan, C99, and Pentest-Tools.
Try the free subdomain finder — no install needed
Enter any domain to discover all its subdomains instantly.
Why Subdomain Enumeration Matters
The main domain is almost never where the interesting attack surface lives. Behind example.com sits a sprawl of subdomains — api.example.com running an unpatched REST framework, staging.example.com with hardcoded credentials, admin.example.com with no authentication, legacy.example.com forgotten since a migration three years ago. These subdomains accumulate over the lifetime of an organization, and they are rarely inventoried with the same rigor as the primary domain. For an attacker or a bug bounty hunter, finding subdomains the organization does not know are exposed is often the fastest path to a meaningful finding.
For defenders, subdomain enumeration is an essential input to attack surface management. You cannot protect assets you do not know exist. Running subdomain discovery against your own domains — and doing it regularly — is one of the simplest ways to find dangling DNS records, abandoned applications, and shadow IT before an attacker does. Certificate Transparency logs alone have exposed countless staging environments that internal teams assumed were invisible to the public internet.
Enumeration approaches fall into two categories. Passive enumeration queries third-party data sources — CT logs, passive DNS datasets, search engine caches, internet scan archives — without sending any traffic to the target. It is stealthy and fast. Active enumeration sends DNS queries directly to the target’s name servers, typically brute-forcing potential subdomain names from a wordlist. Active methods can find subdomains that have never appeared in any public source, but they generate traffic the target can log and they are illegal without explicit authorization.
Choosing between an online tool and a self-hosted CLI comes down to three factors: setup tolerance, automation needs, and data richness. Online tools win on speed and accessibility — you get results without installing anything, and they are usable on any device. Self-hosted CLI tools win on scale, customization, and pipeline integration — they are the right choice when you are running recon across hundreds of domains, need to diff results over time, or are chaining subdomain discovery into a larger automated workflow. This guide covers both categories in depth so you can pick the right tool — or combination of tools — for your specific situation.
Section 1: Online Subdomain Finders (No Install Required)
Online tools remove all setup friction. No runtime to install, no API keys to configure, no binary to download. You open a browser, enter a domain, and get results. The trade-off is that most online tools are passive-only and you are dependent on the provider’s data freshness and rate limits. For initial recon, quick triage, and non-technical users, they are often the right starting point.
1. SubDomainsFinder.com (subdomainsfinder.com)
SubDomainsFinder is a free, browser-based subdomain enumeration tool that requires no account, no installation, and no API keys. You enter a domain and within seconds you get a list of discovered subdomains alongside their resolved IP addresses, detected open ports, ASN, hosting provider, and CDN or WAF detection. The data comes from passive sources: Certificate Transparency logs, passive DNS databases, and public internet scan data — meaning no active probes are sent to the target.
What differentiates SubDomainsFinder from most online tools is that it returns more than just subdomain names. Seeing that staging.example.com resolves to a direct AWS IP with port 8080 open — not behind a CDN — is immediately actionable without needing to chain additional tools. That combination of passive discovery plus infrastructure context in one view saves significant time in the early stages of recon.
- Best for: quick recon, non-technical users, initial triage on a new target, anyone without a configured CLI environment
- Limitation: passive only — no brute-force or active DNS enumeration
- Free tier: yes, fully free with no account required
2. DNSDumpster (dnsdumpster.com)
DNSDumpster is a free online DNS research tool built by HackerTarget.com. It goes beyond subdomains to give you a holistic view of a domain’s DNS configuration — MX records, NS records, TXT records, and a visual network map showing how discovered hosts relate to each other. It uses a combination of passive DNS datasets and its own scanning infrastructure to discover hosts.
The network map visualization is genuinely useful in early recon — it helps you quickly identify which mail servers, nameservers, and web hosts belong to a target organization and which are third-party services. The subdomain list itself tends to be shorter than what you get from CT log-focused tools, but the DNS record context adds meaningful depth.
The main drawbacks are rate limiting and speed. Large domains can take a long time to return results, and repeated queries on the same IP may get throttled. There is no API and no way to automate queries without going through HackerTarget’s paid API offering.
- Best for: DNS record auditing alongside subdomain discovery; understanding MX/NS/TXT configuration at a glance
- Limitation: rate-limited, slower on large domains, shorter subdomain lists than CT-first tools
- Free tier: yes
3. crt.sh (crt.sh)
crt.sh is a Certificate Transparency log search engine maintained by Sectigo (formerly Comodo CA). It runs a PostgreSQL database that continuously ingests CT log entries from all major log operators and makes them searchable via a simple web interface. A search for %.example.com returns every TLS certificate ever issued for any subdomain of example.com, along with issuance dates, the issuing CA, and the log entry details.
The value of crt.sh goes beyond just the current subdomain list. Because CT logs are append-only, crt.sh shows you historical subdomains that may no longer be active — but whose DNS records may still resolve, making them candidates for subdomain takeover. Wildcard certificates (*.example.com) also appear here, which tells you that a large number of potential subdomains exist under a wildcard that would never appear in passive DNS individually. The raw PostgreSQL query interface is available for programmatic access without rate limits for moderate query volumes.
The limitations are all about what crt.sh does not provide: no IP addresses, no port data, no ASN information, no DNS resolution, and no interface polish. The results are a raw table of certificate records. Useful for researchers who know what they’re looking at, but not immediately actionable for someone who needs to know what services are running.
- Best for: CT-log-specific research, certificate analysis, historical subdomain hunting, wildcard certificate detection
- Limitation: raw data with no IP/port/ASN context; no UI polish; CT logs only
- Free tier: yes, fully free
4. SecurityTrails (securitytrails.com)
SecurityTrails is a paid SaaS platform specializing in DNS intelligence and historical data. Its free tier requires account registration and provides around 50 API queries per month — enough to evaluate the product but not enough for production recon workflows. Paid plans unlock bulk access and full historical data depth.
The distinctive value of SecurityTrails is its historical data: you can see not just what DNS records look like today but what they looked like months or years ago, which IP addresses a subdomain has historically resolved to, and which domains have been associated with a given IP over time. This historical view is invaluable for tracking threat actor infrastructure, identifying IP ranges that belong to an organization across cloud providers, and building attribution chains. The platform also integrates with SIEM tools and has a well-documented API that supports programmatic access.
The main barrier is cost. For individual researchers and small teams, the pricing is significant relative to free alternatives. SecurityTrails is best justified when historical DNS data is a primary requirement — for threat intelligence, advanced red team assessments, or enterprise attack surface management programs that need data depth unavailable from free sources.
- Best for: enterprise teams with budget, historical DNS tracking, threat intelligence, SIEM integration
- Limitation: paid beyond 50 queries/month; expensive for individual researchers
- Free tier: yes, with account — 50 queries/month
5. Pentest-Tools Subdomain Finder (pentest-tools.com)
Pentest-Tools.com is a commercial pentesting platform that includes a subdomain finder as one module within a broader suite of automated security testing tools. The subdomain finder combines passive enumeration with active DNS brute-force, returning results in a clean web interface with reporting capabilities. The free tier allows a limited number of scans with some features locked behind paid plans.
The strongest argument for Pentest-Tools is ecosystem integration: if you are already using the platform for web application scanning, network scanning, or vulnerability assessment, having subdomain discovery in the same interface with unified reporting is genuinely convenient. It also supports scheduled scans and team workspaces, making it better suited to ongoing engagements than one-off recon.
For users not already invested in the Pentest-Tools ecosystem, the cost-benefit is less compelling. The subdomain enumeration capability itself is comparable to running Subfinder or Amass free, and the platform cost is only justified by the surrounding tooling.
- Best for: pentesting teams already using the Pentest-Tools suite who want unified reporting
- Limitation: paid; limited value if you’re not using the broader platform
- Free tier: limited — a few free scans with feature restrictions
6. C99 Subdomain Finder (c99.nl)
C99.nl is a paid API-based service offering subdomain discovery among a collection of other reconnaissance and lookup tools. Access requires purchasing API credits, and the service is primarily designed for developers who want to integrate subdomain lookup capabilities into their own tools or pipelines via API calls rather than a web interface.
The C99 database is reportedly large and fast, and the API is well-documented for programmatic integration. It is a reasonable choice when you are building a custom recon tool or application and need a subdomain data source you can call via HTTP without standing up your own infrastructure. The cost model is usage-based, so it is more predictable than subscription services for variable workloads.
For direct use — that is, typing a domain into a box and getting results — the free options covered in this guide are more practical. C99 is really for developers and teams building on top of the API rather than using it interactively.
- Best for: developers integrating subdomain data into automated pipelines and custom tooling via API
- Limitation: requires API key and payment; not designed for interactive use
- Free tier: no meaningful free access
Run a passive subdomain scan right now
No install, no account. Discover subdomains with IPs, ports, and ASN data instantly.
Section 2: Self-Hosted / CLI Subdomain Enumeration Tools
CLI tools require installation but pay dividends at scale. They can process hundreds of domains in parallel, integrate into automated pipelines, be scheduled as cron jobs, and produce machine-readable output for downstream tooling. If you are doing professional recon at any significant volume, a well-configured CLI stack will outperform any browser-based tool. The tools below are the ones professionals actually use in production.
1. Subfinder (by ProjectDiscovery)
Subfinder is the de facto standard for passive subdomain enumeration in professional recon pipelines. Written in Go and maintained by ProjectDiscovery — the team behind nuclei, httpx, naabu, and the broader PDCP ecosystem — it queries over 30 passive sources simultaneously and outputs a deduplicated list of subdomain names to stdout, one per line. That output format is deliberately designed for pipeline composition: pipe it into httpx for HTTP probing, dnsx for DNS resolution, or nuclei for vulnerability scanning without any transformation.
The key nuance with Subfinder is the gap between its default behavior and its full capability. Without API keys configured, Subfinder falls back to a subset of free sources — crt.sh, HackerTarget, and a handful of others — and its coverage is comparable to what you get from a good online tool. The real value unlocks when you configure API keys for Shodan, Censys, SecurityTrails, VirusTotal, and Chaos in ~/.config/subfinder/provider-config.yaml. With full key configuration, Subfinder regularly finds subdomains that CT logs alone miss.
# Install via Go (requires Go 1.21+)
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
# Basic passive scan
subfinder -d example.com -o results.txt
# Silent mode for pipeline use
subfinder -d example.com -silent | httpx -title -status-code
# Scan a list of domains with all sources
subfinder -dL domains.txt -all -o all_results.txt
# Output in JSON for downstream processing
subfinder -d example.com -json -o results.json- Strengths: 30+ passive sources, fast, excellent pipeline integration, actively maintained, composable with httpx and nuclei
- Weaknesses: returns subdomain names only (no IP/port/ASN natively); needs API keys for full coverage; no active enumeration
- Best for: automated pipelines, CI/CD recon, combining with other ProjectDiscovery tools, large-scale passive enumeration
2. OWASP Amass (by OWASP)
OWASP Amass is the most comprehensive subdomain enumeration tool available. It queries over 50 passive data sources, performs active DNS enumeration including brute-force with wordlists, conducts recursive enumeration (finding subdomains of subdomains), performs ASN and CIDR-based host discovery via amass intel, and tracks discovered assets in a local graph database for longitudinal analysis. The breadth of what Amass does in a single tool is unmatched.
The trade-off is complexity and resource consumption. Amass is significantly slower than Subfinder for passive enumeration — a domain that Subfinder processes in 30 seconds may take Amass 5–10 minutes or more with active modes enabled. The configuration file is extensive, and the tool has a steeper learning curve than most alternatives. For teams running it in production, a well-tuned Amass config is an asset that takes time to build.
The amass intel subcommand deserves special mention: given a company name or a known ASN, it can discover IP ranges and CIDR blocks associated with an organization and enumerate subdomains across those entire ranges — a capability no other free tool matches for infrastructure-level discovery.
# Install via Go
go install -v github.com/owasp-amass/amass/v4/...@master
# Passive enumeration only (stealthy)
amass enum -passive -d example.com -o passive_results.txt
# Active enumeration with brute-force
amass enum -active -d example.com -o active_results.txt
# ASN and CIDR discovery from company name
amass intel -org "Example Corp" -asn -ip
# Passive enumeration with config file (recommended)
amass enum -passive -d example.com -config ~/.config/amass/config.yaml
# Visualize the tracked asset graph
amass viz -d3 -d example.com- Strengths: 50+ sources, active + passive, ASN/CIDR enumeration, historical tracking via graph database, most thorough coverage available
- Weaknesses: slow, resource-intensive, complex configuration, steeper learning curve
- Best for: thorough enterprise assessments, long-term attack surface tracking, ASN-level infrastructure discovery
3. Sublist3r (Python)
Sublist3r is a Python-based subdomain enumeration tool that scrapes search engines (Google, Bing, Yahoo, Baidu, Ask, Netcraft) alongside VirusTotal and DNSDumpster, then optionally runs a brute-force pass using the subbrute integration with the -b flag. It was one of the first accessible Python subdomain tools and introduced a lot of security professionals to automated recon workflows.
In 2026, Sublist3r is largely a historical artifact. The repository has seen minimal active maintenance for several years, search engine rate limiting frequently breaks the scraping sources mid-scan, and the result quality is noticeably worse than what Subfinder or Findomain produce from the same passive data sources. The brute-force mode works reasonably well but is slower than modern alternatives like puredns or dnsx.
It is still included here because it is widely referenced in older tutorials, Kali Linux includes it by default, and it remains a useful teaching tool for understanding how search-engine-based enumeration works. For production recon, choose Subfinder or Findomain instead.
# Install via pip
pip install sublist3r
# Basic passive scan
sublist3r -d example.com
# With brute-force on ports 80 and 443
sublist3r -d example.com -b -p 80,443
# Save output to file
sublist3r -d example.com -o results.txt
# Verbose output (shows which sources found each subdomain)
sublist3r -d example.com -v- Strengths: easy Python install, brute-force mode, good for learning
- Weaknesses: largely unmaintained, slow, frequently broken by search engine rate limits, worse coverage than modern alternatives
- Best for: beginners learning recon concepts; not recommended for production engagements
4. Findomain (Rust)
Findomain is a passive subdomain enumeration tool written in Rust, which makes it extraordinarily fast — benchmarks consistently put it ahead of Python and even some Go tools in raw enumeration speed. It queries Certificate Transparency logs (via multiple CT providers), VirusTotal, SecurityTrails, and several other passive sources, returning results in seconds for most domains.
The Rust implementation means a single binary with no runtime dependencies — download it, make it executable, run it. There is no Python environment to manage and no Go toolchain to maintain. The output is clean, one subdomain per line, making it easy to pipe into downstream tools. Findomain is actively maintained and has been a reliable workhorse in recon pipelines where raw speed matters.
Where Findomain falls short relative to Subfinder is in source breadth. It queries fewer passive sources, and without API key configuration (VirusTotal, SecurityTrails, Spyse) it relies primarily on CT logs. For most targets the CT log coverage is substantial, but for targets with significant infrastructure not represented in certificate data, Subfinder with full keys will find more.
# Linux — download the binary
curl -LO https://github.com/Findomain/Findomain/releases/latest/download/findomain-linux
chmod +x findomain-linux
# macOS
curl -LO https://github.com/Findomain/Findomain/releases/latest/download/findomain-osx
chmod +x findomain-osx
# Basic scan
./findomain-linux -t example.com
# Save to file
./findomain-linux -t example.com -o
# With API keys (configure FINDOMAIN_CONFIG or env vars)
export FINDOMAIN_VIRUSTOTAL_API_KEY=your_key_here
./findomain-linux -t example.com- Strengths: very fast (Rust), single binary, actively maintained, clean output
- Weaknesses: fewer passive sources than Subfinder; CT-heavy without API keys
- Best for: fast passive recon when Subfinder feels heavy; quick CT-log-focused enumeration
5. Assetfinder (by tomnomnom)
Assetfinder is a minimal, fast Go tool written by Tom Hudson (tomnomnom) that finds subdomains and related assets from a handful of passive sources including crt.sh, HackerTarget, WayBackMachine, Facebook Certificate Transparency, and a few others. It does exactly one thing: output a list of domains associated with a target, one per line.
Its strength is its simplicity and composability. The --subs-only flag filters output to confirmed subdomains of the target domain, discarding related domains that are not direct subdomains. The output pipes cleanly into httpx with zero transformation: assetfinder --subs-only example.com | httpx gives you live HTTP services in seconds. This pattern is a staple of fast bug bounty workflows where time-to-finding matters.
The limitation is coverage. Assetfinder queries significantly fewer sources than Subfinder and does not support API key configuration for expanded source access. Treat it as a fast first pass or a complement to deeper tools, not as a primary enumeration tool for thorough assessments.
# Install via Go
go install github.com/tomnomnom/assetfinder@latest
# Find all related assets
assetfinder example.com
# Subdomains only (recommended)
assetfinder --subs-only example.com
# Fast pipeline — find subs, probe HTTP, grab titles
assetfinder --subs-only example.com | httpx -title -status-code -silent- Strengths: lightweight, fast, excellent pipeline composability, dead-simple usage
- Weaknesses: fewer sources than Subfinder; no API key support for expanded coverage
- Best for: minimal-footprint fast recon; first pass in a larger pipeline; quick bug bounty triage
6. theHarvester (Python / Kali default)
theHarvester is an OSINT tool that aggregates subdomains, email addresses, IP addresses, and employee names from search engines, public databases, and various passive sources. It ships by default in Kali Linux and is a standard tool in the OSINT phase of penetration testing. Unlike pure subdomain tools, it is explicitly designed to gather multiple types of intelligence in a single pass — making it useful when you want both subdomain discovery and email address harvesting for phishing simulation or credential spray preparation.
The subdomain discovery quality is reasonable but not state-of-the-art. Search engine sources are prone to rate limiting, and theHarvester is notably slower than purpose-built subdomain tools when you only need subdomain data. The -b all flag queries all configured sources, which includes Shodan (if configured), Bing, Google, LinkedIn, Twitter, and several others — a broad net that occasionally surfaces unique findings, particularly from social media intelligence.
# Install via pip
pip install theHarvester
# On Kali Linux it is pre-installed
# Basic scan against all sources
theHarvester -d example.com -b all
# Target specific sources
theHarvester -d example.com -b bing,google,shodan
# Output to XML report
theHarvester -d example.com -b all -f report.xml
# Limit result count to avoid rate limits
theHarvester -d example.com -b google -l 200- Strengths: combines subdomain + email + IP + employee data in one tool; Kali default; good for OSINT-heavy initial recon
- Weaknesses: slow, dependent on search engine rate limits, subdomain coverage weaker than dedicated tools
- Best for: OSINT-heavy initial recon phases that combine email harvesting with subdomain discovery
7. Shodan (shodan.io)
Shodan is not a subdomain finder in the traditional sense — it is an internet-wide scan engine that indexes hosts, open ports, service banners, TLS certificate metadata, and application fingerprints from continuous internet scanning. But it is an essential complement to subdomain enumeration because it can reveal infrastructure that CT logs and passive DNS miss: hosts running services on non-standard ports, IoT devices, industrial control systems, and servers that have never hosted a web application.
The key Shodan query for subdomain-adjacent discovery is hostname:example.com, which returns all hosts Shodan has indexed with that hostname in their TLS certificate or DNS PTR record. This surfaces services on non-standard ports, services running without HTTP (databases, SMTP, FTP), and hosts in IP ranges that do not appear in passive DNS. The ssl.cert.subject.cn:example.com query adds certificate-based discovery on top.
The free tier of Shodan is limited to basic search results with no API access. The paid Shodan membership (one-time fee of around $49) unlocks full API access, filters, and programmatic integration. The Shodan CLI and Python library make it straightforward to incorporate into recon pipelines.
# Install Shodan CLI
pip install shodan
shodan init YOUR_API_KEY
# Find hosts by hostname
shodan search hostname:example.com
# Find by SSL certificate CN
shodan search ssl.cert.subject.cn:example.com
# Count results
shodan count hostname:example.com
# Download full result set (requires paid plan)
shodan download results hostname:example.com- Strengths: reveals services on non-standard ports; finds infrastructure not in CT logs; service banner data
- Weaknesses: not a subdomain finder per se; paid API beyond basic search; data freshness varies
- Best for: complementing subdomain enumeration with port/service discovery; finding origin IPs behind CDNs; IoT/OT asset discovery
Section 3: Full Feature Comparison Table
The table below compares all 13 tools across the dimensions that matter most for practical subdomain enumeration work. Use it as a quick reference when choosing tools for a specific engagement or workflow.
| Tool | No Install | Free Tier | Passive Discovery | Active / Brute-Force | IP Addresses | Open Ports | ASN / Hosting | Historical Data | API Available | Actively Maintained |
|---|---|---|---|---|---|---|---|---|---|---|
| SubDomainsFinder.com | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✓ |
| DNSDumpster | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | partial | ✗ | paid | ✓ |
| crt.sh | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✓ |
| SecurityTrails | ✓ | limited | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ |
| Pentest-Tools | ✓ | limited | ✓ | ✓ | ✓ | ✓ | partial | ✗ | paid | ✓ |
| C99 | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✓ | ✓ |
| Subfinder | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
| OWASP Amass | ✗ | ✓ | ✓ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ |
| Sublist3r | ✗ | ✓ | ✓ | partial | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Findomain | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ |
| Assetfinder | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | partial |
| theHarvester | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ |
| Shodan | ✓ | limited | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | paid | ✓ |
✓ = yes ✗ = no partial = limited/conditional limited = free tier with significant restrictions paid = available but requires payment
Section 4: How to Combine Tools — Practical Workflows
No single tool covers the entire enumeration surface. Professional recon is a layered process: start with the fastest passive sources to build a baseline, add deeper passive coverage for completeness, then optionally layer active brute-force for targets where maximum coverage justifies the noise. The two workflows below represent patterns that work well in real engagements.
Workflow 1: Quick Bug Bounty Recon (No Install)
When you are triaging a new scope or doing initial reconnaissance on a target and do not have your full CLI environment available, this three-step online workflow takes under five minutes and covers the major passive sources.
Enter the target domain. Note all subdomains with direct IPs (not CDN), unusual open ports (8080, 8443, 3000, 8888, 9200), and any subdomains resolving to cloud provider IPs (AWS, Azure, GCP) — these are higher-priority investigation targets. Export or copy the full list for the next step.
Go to crt.sh and search for %.targetdomain.com. Look for subdomains that did not appear in SubDomainsFinder (may be decommissioned but still have live DNS), wildcard certificates that suggest large subdomain ranges, and certificate issuance dates that reveal when specific services went live. Cross-reference against your SubDomainsFinder results to identify gaps.
Check DNSDumpster for the DNS record overview. MX records reveal mail providers (and potential phishing entry points). NS records show if the domain uses third-party DNS that might have misconfiguration risks. TXT records often expose SPF/DKIM/DMARC gaps, verification tokens for third-party services, and occasionally sensitive internal information accidentally committed to a public DNS record.
Workflow 2: Deep Automated Pipeline (CLI)
For serious engagements, bug bounty programs with large scopes, or continuous attack surface monitoring, this CLI pipeline provides maximum passive coverage, live host identification, and vulnerability scanning in a reproducible, scriptable workflow. This pattern runs on Linux or macOS and requires Go-based tools installed in your PATH.
#!/bin/bash
# Deep subdomain enumeration pipeline
# Requirements: subfinder, assetfinder, httpx, nuclei
# Install ProjectDiscovery tools: https://github.com/projectdiscovery
TARGET="example.com"
WORKDIR="./recon-$TARGET"
mkdir -p "$WORKDIR"
# Step 1: Passive enumeration from multiple sources
echo "[*] Running passive enumeration..."
subfinder -d "$TARGET" -silent -o "$WORKDIR/subs_subfinder.txt"
assetfinder --subs-only "$TARGET" > "$WORKDIR/subs_assetfinder.txt"
# Optional: Amass passive for deeper coverage (slower)
# amass enum -passive -d "$TARGET" -o "$WORKDIR/subs_amass.txt"
# Step 2: Deduplicate all results
cat "$WORKDIR"/subs_*.txt | sort -u > "$WORKDIR/unique_subs.txt"
TOTAL=$(wc -l < "$WORKDIR/unique_subs.txt")
echo "[*] Found $TOTAL unique subdomains"
# Step 3: Resolve and probe live HTTP services
echo "[*] Probing for live HTTP services..."
cat "$WORKDIR/unique_subs.txt" | httpx -silent -title -status-code -tech-detect -o "$WORKDIR/live_hosts.txt"
LIVE=$(wc -l < "$WORKDIR/live_hosts.txt")
echo "[*] $LIVE live HTTP services found"
# Step 4: Vulnerability scan against live hosts
echo "[*] Running nuclei scan..."
nuclei -l "$WORKDIR/live_hosts.txt" -t technologies/ -t exposures/ -t misconfiguration/ -severity medium,high,critical -o "$WORKDIR/findings.txt"
echo "[*] Pipeline complete. Results in $WORKDIR/"
echo " Subdomains: $WORKDIR/unique_subs.txt"
echo " Live hosts: $WORKDIR/live_hosts.txt"
echo " Findings: $WORKDIR/findings.txt"For programs with large scope or when you need active brute-force coverage on top of passive results, add a puredns or dnsx brute-force pass after Step 2, using SecLists’dns/subdomains-top1million-110000.txt wordlist against a reliable DNS resolver list. The active pass typically adds 10–30% more subdomains over passive-only results for mature targets.
Section 5: Choosing the Right Tool for Your Situation
The right tool is the one that matches your constraints and goals. Here is a direct, practical guide to picking the right starting point based on what you actually need.
Need results in 30 seconds without installing anything?
SubDomainsFinder.com or DNSDumpster.
Open a browser, enter the domain, done. SubDomainsFinder adds IP, port, and ASN context. DNSDumpster adds DNS record depth. Use both for two minutes of coverage that rivals a basic Subfinder run.
Need the most thorough passive + active coverage?
OWASP Amass.
Amass is unmatched in depth when you have time for it. Run amass enum -passive first for the broad sweep, then amass enum -active with a wordlist for the gaps. Use amass intel to discover IP ranges associated with the target org. Accept that it will be slow and configure it with API keys for best results.
Need to automate recon in CI/CD or across a large scope?
Subfinder.
Subfinder is the right tool when you need reproducible, scriptable, pipeline-friendly output. It runs headlessly, integrates cleanly with httpx and nuclei, and handles concurrent multi-domain enumeration via -dL. Configure provider-config.yaml with all available API keys to maximize its source coverage.
Running Kali and want a quick CLI with no configuration?
Assetfinder or Findomain.
Both install in seconds and produce clean output immediately. Assetfinder is lighter and pipes beautifully into httpx. Findomain is faster for larger domains. Neither requires API keys to produce useful results. Sublist3r is already on Kali but is not recommended for production — use it only for learning.
Need historical DNS data or long-term infrastructure tracking?
SecurityTrails.
SecurityTrails has no peer for historical DNS data depth. If you need to understand what IP a subdomain resolved to six months ago, which domains have been associated with a known malicious IP over time, or how a target’s infrastructure has evolved, SecurityTrails is the tool. The cost is justified for threat intelligence and mature ASM programs.
Want to look at certificates specifically?
crt.sh.
For Certificate Transparency log research — finding all certs ever issued for a domain, identifying wildcard certificates, or hunting for subdomain takeover candidates in historical cert data — crt.sh is the most direct tool. The SQL query interface at crt.sh/? is available for power users who need bulk queries.
Need both subdomain discovery and email addresses for OSINT?
theHarvester.
theHarvester is the only tool in this list that gathers email addresses, employee names, and IP addresses from search engines alongside subdomain data. For phishing campaign preparation, pre-engagement OSINT, or social engineering research, its multi-signal approach in a single tool saves time. Accept the slowness — it is a deliberate trade-off for breadth.
Building a custom tool or integrating subdomain data via API?
C99 or SecurityTrails API.
Both offer well-documented APIs with reasonable performance for programmatic access. C99 is usage-based and lower cost for variable workloads. SecurityTrails provides richer data including historical records. For building your own recon platform, evaluate both against your volume and data requirements.
Want to find services on non-standard ports or behind unusual infrastructure?
Shodan, as a complement to subdomain tools.
Run hostname:example.com in Shodan to find indexed hosts not surfacing in CT logs or passive DNS. This is particularly effective for finding origin servers behind CDNs, databases accidentally exposed to the internet, and services on unusual ports that no subdomain tool would discover through DNS alone.
Frequently Asked Questions
What is subdomain enumeration?
What is the best subdomain enumeration tool in 2026?
Is passive subdomain discovery enough for a pentest?
What's the difference between active and passive subdomain enumeration?
Which subdomain finder finds the most subdomains?
Can I use these tools legally?
What is Certificate Transparency and how does it help find subdomains?
How do I find subdomains without installing any tools?
Which subdomain tool works best for bug bounty?
Do any of these tools find subdomains that aren't in CT logs?
Final Thoughts
Subdomain enumeration in 2026 is a solved problem at the tool level — the hard part is choosing the right combination of tools for your specific context and constraints. If you take nothing else from this guide: no single tool is complete on its own. The professionals who consistently find the most subdomains are the ones who layer passive sources from multiple tools, deduplicate aggressively, and then add a targeted active brute-force pass on top. The marginal time investment in running Subfinder plus Assetfinder plus a crt.sh query, then diffing the results, is almost always worth the additional unique subdomains you find.
For quick, accessible recon with immediate infrastructure context — especially when you do not have a CLI environment ready or are doing initial triage — SubDomainsFinder.com is a practical starting point. For deep, automated, production-grade enumeration, Subfinder and Amass are the tools the professional community has converged on for good reasons. Use the comparison table and decision guide above to build the stack that matches your actual workflow, and remember: the goal is not to use the most tools, but to find the most actionable findings with the least wasted effort.
Tool-specific comparisons
Looking for a deeper dive on how SubDomainsFinder compares to a specific tool?
Ready to start? Run a free subdomain scan.
Discover subdomains with IPs, open ports, ASN, and CDN/WAF detection — no account or install needed.