Free subdomain finder online 🛡️ find subdomains of domain (2024)

What is a Subdomain Finder?

A Subdomain Finder is a subdomain enumeration tool that helps you discover subdomain hosts (aka subdomain FQDNs) which serve specific functions for your target (e.g. hosting public websites, private subdomains for testing web apps, URLs where you can find backups, etc.).

Manual methods involve a lot of time and effort to retrieve subdomain information, taking away precious resources from completing your time-limited engagements.

Since finding subdomains is an important step in the information gathering stage of a penetration test, we built a Subdomain Finder to maximize your chances of finding vulnerabilities worth pursuing.

For an ethical hacker, subdomains are interesting because they point to various (less-known) applications and indicate various external network ranges the target company uses.

For instance, a subdomain finder report might show you that subdom1.company.com points to IP 1.1.1.1 and subdom2.company.com points to IP 2.2.2.2. Now you know two different IP addresses your target organization might own and you can extend the attack surface while still operating in the scope of the engagement.

Subdomains sometimes host applications for internal use (e.g. test, development, backup, restricted) that are usually less secure than public/official applications, which makes them attractive targets for cybercriminals.

Our automatic subdomain enumeration helps you retrieve not just subdomains, but also their IP address, WHOIS information (netname and country), OS, server and its technology, plus the web platform running on them and the page title – all in scope of the security assessment you’re tasked with performing.

What makes our Subdomain Finder different

The effectiveness of any pentesting tool depends on the ecosystem it’s part of. Because we know much work it takes to connect different tools and ensure you can follow your workflow without interruptions, we built Pentest-Tools.com with this in mind.

Instead of offering a Subdomain Scanner as a standalone tool, we chose to offer the ability to chain the results with our other tools from the start. As a result, our platform provides an entire ecosystem of tools and features you can even combine into automated testing sequences.

To make it easy for you to find all subdomains and identify low hanging fruit as well as less obvious potential entry points, we combined almost a dozen search methods with various enumeration wordlist options, and even the ability to include unresolved subdomains.

On top of the ability to use your own wordlists for enumeration and fuzzing, you can also use our Subdomain Finder to get extra information about the subdomains it finds, including IP address, WHOIS, and web server and web technologies information built-in (if applicable). Plus, you can easily filter results to surface the most useful findings you need to move forward.

How our Subdomain Finder works

If you’re looking for domain checker tools that are free to use, you can try our Subdomain Finder for free with the Light scan version. This searches DNS records (NS, MX, TXT, AXFR) and performs subdomain enumeration using a built-in wordlist.

The Deep scan version delivers speed, accuracy and extensiveness, all together, along with access to all the pentesting tools and features on the platform. The Deep scan uses multiple techniques to find subdomains fast and effectively:

  • DNS records (NS, MX, TXT, AXFR)
  • Enumeration using built-in wordlists, plus the option to use your own
  • External APIs search
  • Public search engine queries (Google search, Bing)
  • Word mutation techniques
  • Searching in SSL certificates
  • Parsing HTML links
  • Reverse DNS on target IP ranges
  • Generates permutations and alterations of the subdomain names found so far in the scan
  • Searching in CNAME records

On top of the subdomains list, you can customize the output to include:

  • Unresolved domains
  • IP addresses of the found subdomains
  • WHOIS information
  • Operating system information
  • Web server and web technologies.
Free subdomain finder online 🛡️ find subdomains of domain (1)

Subdomain Finder is a comprehensive tool, so scan duration varies depending on the target. For an average domain, a subdomain scan takes just a few minutes. For instance, it can return up to 500 results in under 10 minutes.

For domains with thousands or tens of thousands of subdomains, such as websites in the government, educational, medical, etc. sectors, subdomain scans can take up to a few hours. To slightly increase scanning speed, deactivate the “Detect web technologies” option.

Scanning parameters for paying customers

When you choose a paid plan and log into your Pentest-Tools.com account, you get eight additional detections methods and can select and combine the following subdomain scanning parameters to customize the output:

ParameterDescription
Include IP informationCheck this to instruct the tool to do WHOIS queries in order to determine the network owners and country for each IP address.
Detect web technologies Use this option to have the tool try to find more details about each extracted subdomain, such as: OS, Server, Technology, Web Platform and Page Title.
Include unresolved subdomainsGives you the option of keeping unresolved subdomains in the list of results, but without an IP address.

What to do next

Besides the Subdomain Finder, you have other domain checker tools on Pentest-Tools.com, along with a full arsenal of vulnerability scanners and exploitation tools.

Our solution for finding domains, our free Google Hacking tool, and Find Virtual Hosts provide breadth by extending your attack surface. Enhance your reconnaissance work with complementary tools such as the Port Scanner, the UDP Port Scanner, and the Website Recon tool which provide you with in-depth information about a specific target.

Our Subdomain Finder is also closely connected to all other tools on the platform, which allows you to get much more information about subdomains and act on it with precision and speed.

Web vulnerability scanners, web CMS scanners, and network vulnerability scanners are all available from your online account, along with powerful offensive tools (e.g. URL Fuzzer, Subdomain Takeover, Sniper Auto-Exploiter, and more).

We make it easy to access the one that is relevant to your next steps from the list of subdomain results to remove as much repetitive work from your day as possible.

Free subdomain finder online 🛡️ find subdomains of domain (2)

Automation features also help you expedite entire testing sequences. For instance, Recon Robot, one of our pentest robots, automatically discovers all subdomains of any given domain, does full port scanning and service discovery, and gathers technologies and takes screenshots for each web port it finds. It also delivers all the data it aggregates in the unified Attack Surface view. All without you having to wait for scans to finish to start follow-up scans with different tools and other work that disrupts your flow.

Use this Subdomain Finder with other features in our cloud platform to further boost its capabilities:

  • Webhooks for real-time notifications
  • Scheduled scans and bulk scanning
  • sharing for effective collaboration
  • Finding templates and report templates for high-speed reporting
  • API access for integrating it into your own pentesting stack.

Plus, the entire arsenal on Pentest-Tools.com gets updates on a regular basis, consistently growing stronger with new features.

Free subdomain finder online 🛡️ find subdomains of domain (2024)

FAQs

How do I check all subdomains of a domain? ›

There are several ways to find subdomains:
  1. Manually, by using the site:* operator in Google.
  2. By checking DNS records using the nslookup command.
  3. By using our online subdomain scanner or similar tools.

How to get a free subdomain? ›

To use or change a free subdomain:
  1. From your Square Online Overview page, go to Website > Domains.
  2. Select Connect domain.
  3. Select Use a Square subdomain and enter your preferred subdomain name (like "mybusiness. ...
  4. Select Change when finished.
  5. Publish your site in the Square Online site editor to see your changes live.

What is the tool to find live subdomains? ›

Sublist3r is a powerful Python tool designed for subdomain enumeration using open-source intelligence (OSINT). Well-suited for penetration testers, Python users, and bug hunters, Sublist3r finds subdomains using Ask, Baidu, Bing, Yahoo, Google, ReverseDNS, DNSDumpster, VirusTotal, and Netcraft.

How to search subdomains in Google? ›

Google Dorking

Google Dorks are one of the best ways to find extenstive information about a target. Google's search operators make it easy to narrow down the search to find more subdomains. We can use the "site" operator in the search bar to find all the subdomains that Google has indexed for a domain.

How many subdomains does a domain have? ›

Each domain name can have up to 500 subdomains. You can also add multiple levels of subdomains, such as info.blog.yoursite.com. A subdomain can be up to 255 characters long, but if you have multiple levels in your subdomain, each level can only be 63 characters long.

Are subdomains included with the domain? ›

Subdomains are used to expand the use of a single domain, these do not need to be purchased separately to your domain; if you own a domain then you can add a subdomain to this. This method is commonly used for Moodle and Totara site setups.

Do I own a subdomain if I own a domain? ›

If you buy a domain you control all of its subdomains, but if you have no hosting then you will have nowhere to connect the subdomains to. So yes, you get access to all the domain's subdomains, and you could even forward the subdomain to any page you like for free if your registrar offers free domain forwarding.

Is a subdomain free in GoDaddy? ›

Creating a free subdomain on GoDaddy is an easy and quick process. You can create it by adding an “A” DNS record which points to an IP address of your main domain name. Alternatively, you can create a subdomain as a CNAME which points to your main domain name. Do note that a CNAME can't point to an IP address.

How to get 100% free domain name? ›

How to Get A Free Domain Name in 2024
  1. Hostinger (Free Domain Name Included) ...
  2. Wix (Free Website Buider & .com Subdomain) ...
  3. Bluehost (Free Website Domain Included .com, co.uk, org, . ...
  4. Dreamhost (Free Domain is Included on all Plans) ...
  5. 1&1 IONOS (Free .co.uk) ...
  6. Weebly (FREE subdomain/.com) ...
  7. Dot.tk (FREE.tk) ...
  8. Biz.nf (FREE .co.nf)
Apr 17, 2024

What is a subdomain finder? ›

A Subdomain Finder is a subdomain enumeration tool that helps you discover subdomain hosts (aka subdomain FQDNs) which serve specific functions for your target (e.g. hosting public websites, private subdomains for testing web apps, URLs where you can find backups, etc.).

Who owns a subdomain? ›

Let's say you are making a pitch to a client to create their new website. You can create a subdomain that is specifically intended for them to give an idea of what their new website might look like. This is hosted on your own main domain, while retaining ownership of the subdomain.

How does Google view subdomains? ›

However, Google treats subdomains as separate sites.

While “blog.example.com” and “example.com” may share a root domain, Googlebot will view them as distinct domains and crawl and index them accordingly.

How do I find all the subsites of a website? ›

You can usually locate it in the root or footer section of the website. For example, the XML sitemap URL could be “www.example.com/sitemap.xml“. Once you click on the sitemap, you will find all pages & subpages of a website. You can use different sitemap generation tools if you don't have an existing sitemap.

Does Google Search Console include subdomains? ›

Yes. you can verify your subdomain to be used in Google Search Console by linking your account to Google Analytics. This way you avoid customizing the theme of your help center. Go to www.google.com/analytics and set up a property within your Google Analytics account for your subdomain.

Does Google charge for subdomains? ›

Subdomains are free. With the right hosting plan, you can add subdomains at no additional cost. If it is that you have a large amount of subdomains on one domain, Google will not penalize you. It is rather easy to install/upload anything to a subdomain without impacting your main site.

How do I find subdomains in nslookup? ›

Find Subdomains of a Domain with NsLookup:

Replace “example.com” with the domain name you are interested in. This command will return a list of the authoritative name servers for the domain, which can often include the subdomains.

How do I verify a sub domain? ›

you can verify your subdomain to be used in Google Search Console by linking your account to Google Analytics. This way you avoid customizing the theme of your help center. Go to www.google.com/analytics and set up a property within your Google Analytics account for your subdomain.

How to find all records for a domain? ›

How Do I Perform a DNS Lookup Using Command-Line Tools?
  1. Open Command Prompt.
  2. Enter nslookup domain.com to perform a DNS lookup for the domain.

How do I find subdomains in GoDaddy? ›

How to Add a Subdomain in GoDaddy?
  1. Log in to your GoDaddy account.
  2. Go to the “My Products” section and click on “DNS” next to the domain you want to add a subdomain to.
  3. In the DNS Management page, scroll down to the “Add” section and click on the “Add” button next to “Subdomains”.
Aug 26, 2023

References

Top Articles
Latest Posts
Recommended Articles
Article information

Author: Greg Kuvalis

Last Updated:

Views: 5910

Rating: 4.4 / 5 (75 voted)

Reviews: 90% of readers found this page helpful

Author information

Name: Greg Kuvalis

Birthday: 1996-12-20

Address: 53157 Trantow Inlet, Townemouth, FL 92564-0267

Phone: +68218650356656

Job: IT Representative

Hobby: Knitting, Amateur radio, Skiing, Running, Mountain biking, Slacklining, Electronics

Introduction: My name is Greg Kuvalis, I am a witty, spotless, beautiful, charming, delightful, thankful, beautiful person who loves writing and wants to share my knowledge and understanding with you.