Subdomain Finder

What Is Subdomain Enumeration?

Subdomain enumeration is the process of finding all subdomains that belong to a domain. Every subdomain — staging.example.com, api-v2.example.com, jenkins.internal.example.com — is a potential entry point. Attackers use subdomain discovery as the first step of reconnaissance because forgotten or misconfigured subdomains are one of the easiest things to exploit.

A free subdomain finder online automates this process. Instead of guessing subdomain names, it queries public data sources that already know which subdomains exist. The most reliable source is Certificate Transparency logs — public records of every SSL/TLS certificate issued by trusted Certificate Authorities.

How Certificate Transparency Subdomain Discovery Works

Since 2018, every certificate issued by a publicly trusted CA must be logged to at least two CT logs before browsers accept it (RFC 9162). This creates a complete, searchable record of every subdomain that has ever had a certificate.

When you enter a domain into this subdomain finder, it queries the crt.sh database — which aggregates logs from Google Argon, Cloudflare Nimbus, DigiCert Yeti, and others. For each certificate, it extracts the Subject Alternative Names (SANs) — the actual subdomain entries. After deduplication, you get a clean list of every subdomain with certificate history.

This is passive reconnaissance. No traffic is sent to the target domain. The data is entirely public. That's why CT-based enumeration is the standard first step in both authorized penetration testing and bug bounty programs.

5 Methods for Finding Subdomains

CT log queries are the most reliable method, but security professionals combine multiple techniques:

This tool uses the CT log method. For deeper enumeration, tools like subfinder and Sublist3r combine multiple data sources in a single scan.

Using Subdomain Findings for Bug Bounty

Subdomain discovery is the most common first step in bug bounty recon. Here's what to look for once you have a subdomain list:

• Subdomain takeover — A subdomain points to a service (Heroku, S3, Azure) that's been deprovisioned. If you can claim that service, you control the subdomain. Check for CNAME records pointing to unclaimed resources.
• Exposed admin panels — Subdomains like admin.*, jenkins.*, grafana.*, or kibana.* often have weaker access controls than the main application.
• Staging and development servers — staging.*, dev.*, test.* environments frequently run with debug mode enabled, default credentials, or outdated software.
• API endpoints — api-v1.*, api-internal.* may expose deprecated or undocumented API versions without proper authentication.
• Forgotten services — Subdomains with old "Last Seen" dates in CT logs may be running unpatched software that nobody monitors.

Always ensure you have explicit authorization before testing discovered subdomains. CT log data is public, but interacting with the services requires permission.

What Is Subdomain Takeover?

Subdomain takeover happens when a subdomain's DNS record (usually a CNAME) points to an external service that no longer exists. If an attacker registers that service, they control the subdomain.

Common takeover targets include AWS S3 buckets, GitHub Pages, Heroku apps, Azure Blob Storage, and Shopify stores. The subdomain blog.example.com might CNAME to example.herokuapp.com — if that Heroku app was deleted but the DNS record wasn't removed, anyone can create a new Heroku app with that name and serve content under blog.example.com.

After running a subdomain scan, check each discovered subdomain's DNS records for dangling CNAMEs. Tools like subjack and can-i-take-over-xyz automate this check.