We use cookies.This website uses essential cookies to operate core features. With your consent, we also use analytics cookies to understand traffic and improve the service. For more details, see our .
We use cookies.This website uses essential cookies to operate core features. With your consent, we also use analytics cookies to understand traffic and improve the service. For more details, see our .
Was this tool helpful to use?
Your feedback helps us make it better
Quickly scan and find all active subdomains for a target domain. Generate a standardized list for security assessments and asset management.
Enter details to see results
Overview
Understand what the tool solves, how it works, and the boundaries of its data.
Enter a domain such as example.com and run the scan to see names returned for that target. A subdomain is a DNS name beneath another domain: api.example.com is beneath example.com, and v2.api.example.com is also beneath it. The result area shows a count and a line-by-line list; use its copy control to take the names into an asset inventory or review worksheet.
DNS naming follows a hierarchy, as described in RFC 1034. OWASP also places DNS enumeration and subdomain discovery within broader attack-surface identification; a list is only one input to that work.
Guide
Follow the workflow and verify inputs and outputs with practical examples.
Enter the domain you intend to review, for example example.com. A bare domain is easiest to read and record. The input also accepts a URL; when you omit a scheme, the page submits it with HTTPS.
Choose the scan control and wait for the result. When names are returned, check the displayed count and inspect the list. A result row has an Open link, while the copy control copies the names separated by new lines.
Paste the copied names into your authorized asset review. Compare them with the domain owner’s DNS records and asset register, then add an owner, purpose, environment, and review date. Treat each name as a lead to confirm.
Use the intended management boundary as the target. For example, a separately delegated subdomain may need its own review; do not assume submitting www.example.com is equivalent to submitting example.com.
Use cases
See how the tool fits into real work and everyday tasks.
For a domain your organization manages, compare returned names with the authoritative DNS zone and the current asset register. Investigate names without a clear owner and annotate confirmed services.
After an approved launch or decommissioning, capture a scan result and compare it with the change record. Use discrepancies to ask whether a name is expected, stale, or assigned to another team.
Within an explicitly authorized scope, use the list to plan follow-up checks. OWASP’s attack-surface guidance describes discovery as one part of assessment; this list does not itself test for a vulnerability.
Q&A
Find concise answers to common questions and confusing cases.
The result list contains the names returned for that scan. The page does not show a discovery-method description or a coverage figure.
A listed name is a DNS-style name returned in the scan. Check it with the relevant DNS records and service owner to understand its current role.
Yes. Use the copy control beside the result count. It copies the list as newline-separated text for a spreadsheet, text file, or inventory workflow.
Notes
Review scope, result limitations, and important precautions before use.
Use results as unverified leads. This scan does not establish complete domain coverage, current DNS status, web availability, ownership, or vulnerability status.
Related
Discover related tools, collections, and available API capabilities.