FAQs
The Deep scan uses multiple techniques to find subdomains fast and effectively:
- DNS records (NS, MX, TXT, AXFR)
- Enumeration using built-in wordlists, plus the option to use your own.
- External APIs search.
- Public search engine queries (Google search, Bing)
- Word mutation techniques.
- Searching in SSL certificates.
Is subdomain enumeration legal? ›
This type of subdomain enumeration is resource-intensive and may have legal and ethical implications since sending large requests to a target domain is required. Because of its intrusive nature, active subdomain enumeration may trigger security alerts.
How does subdomain finder work? ›
Subdomain Finder scans the DNS records and supplementary databases to analyze the domain's hierarchy. Our subdomain scanner checks: DNS records (NS, MX, TXT, AXFR)
What is subdomain hijacking? ›
It's a cyber threat executed when an attacker gains control of a legitimate subdomain that's no longer in use, then cleverly exploits the forgotten or misconfigured dangling DNS to host their own content on the previously used zone.
What is the best tool to find subdomains? ›
Here are ten highly effective options.
- Google Dorking. Google Dorking is a passive subdomain enumeration technique using Google's advanced search operators, like "site:" to find information about a target, including subdomains. ...
- Sublist3r. ...
- Amass. ...
- Recon-ng. ...
- SubDomainizer. ...
- Pentest Tools Subdomain Finder. ...
- crt.sh. ...
- Shodan.
Do subdomains count for SEO? ›
Optimize Your Subdomains & Subdirectories for SEO
The choice between subdomains and subdirectories largely depends on reasons outside of SEO. Both can be SEO-friendly. Whether you decide to use subdomains or subdirectories, you need to optimize them for the best chance of ranking in search engines.
Do I own a subdomain if I own a domain? ›
Yes. When you purchase the root domain, you can set up any subdomain you want on that root domain. Before you use Google Search Console (used to be Google Webmaster Tool), you should set up your site so that all traffic going to the root domain gets redirected to the www version.
What are the risks of subdomains? ›
Websites that use multiple subdomains risk exposing themselves to cyberattacks. Subdomain takeovers can lead to data breaches and reputational damage. However, these risks can be minimized with the right strategies, and your organization can stay protected.
Why is subdomain not secure? ›
to secure a subdomain you need to either generate a new certificate for each subdomain or use a wildcard SSL certificate. A wildcard SSL certificate will automatically secure the main domain and all subdomains. A wildcard SSL certificate can be generated by using the Let's Encrypt DNS verification method.
What tool is used to find subdomain takeover? ›
Subdominator is a dependable and fast open-source command-line interface tool to identify subdomain takeovers.
Subdomain stripping is the process of removing the subdomains from the main domain and delivering the emails to the main domain directly.
What can hackers do with subdomains? ›
Here are just the 11 most common ways cybercriminals use hacked subdomains:
- 1) Deface a website page and hurt a company's reputation. ...
- 2) Steal user data. ...
- 3) Create a “phishing” page on a credible subdomain. ...
- 4) Put a redirect to a malicious website. ...
- 5) Blackmail a company to get paid. ...
- 6) Steal the source code of a website.
How to search subdomains in Google? ›
Google Dorking
Google Dorks are one of the best ways to find extenstive information about a target. Google's search operators make it easy to narrow down the search to find more subdomains. We can use the "site" operator in the search bar to find all the subdomains that Google has indexed for a domain.
How to list all DNS records in nslookup? ›
Using nslookup online is very simple. Enter a domain name in the search bar above and hit 'enter'. This will take you to an overview of DNS records for the domain name you specified.
How many subdomains is too many? ›
A domain can have up to 500 subdomains. You can create multiple levels of subdomains such as store.product.yoursite.com, test.forum.yoursite.com, etc. Each subdomain can be up to 255 characters long, but for multi level subdomains, each level can only be 63 characters long.
How do I find subdomains of a domain using nslookup? ›
Find Subdomains of a Domain with NsLookup:
Replace “example.com” with the domain name you are interested in. This command will return a list of the authoritative name servers for the domain, which can often include the subdomains.