Subdomains Discovery

FFUF

See also FFUF for fuzzing-based subdomain discovery.

Google Dorking

Google dorks can surface subdomains indexed by Google without any active scanning.

site:*.$domain
site:*.$domain -www
site:*.$domain inurl:admin
site:*.$domain ext:php | ext:json | ext:xml

Certificate Transparency

CT logs record every TLS certificate ever issued for a domain. Querying them is passive and reliable.

curl -s "https://crt.sh/?q=%25.$domain&output=json" | jq '.[].name_value' | sort -u

Tools that aggregate CT logs:

• crt.sh
• censys.io

Passive DNS

Passive DNS databases store historical DNS resolutions collected from resolvers worldwide; useful for finding subdomains that no longer resolve but once did.

# Amass (passive mode, no active scanning)
amass enum -passive -d $domain

# subfinder (uses many passive sources)
subfinder -d $domain -silent

DMARC

DMARC can reveal more domains associated with a target.

Go to dmarc.live/info/$domain, it allows you to find domains using the same DMARC record.

ASN & IP Ranges

Finding the ASN of a target exposes its entire IP range, which may contain undiscovered subdomains or related infrastructure.

# Get ASN from an IP
whois $ip | grep -i "asn\|orgname\|origin"

# Get IP ranges from ASN
whois -h whois.radb.net -- '-i origin AS12345' | grep route

Favicon Hash

A unique favicon can be fingerprinted to find other domains hosted by the same organisation, including subdomains on non-standard ports.

# Compute the MMH3 hash of the favicon
python3 -c "
import requests, mmh3, base64
r = requests.get('https://$domain/favicon.ico')
h = mmh3.hash(base64.encodebytes(r.content))
print(h)
"

Then search the hash on Shodan: http.favicon.hash:<hash>