Pentestas / help

Subdomain Finder

Subdomain Finder — Discover subdomains and map the attack surface of a domain.
Subdomain Finder in the Pentestas Security tools UI.

Category: Network recon

Enumerates hostnames under a root domain using certificate transparency, passive DNS, and targeted DNS brute-force. Resolves each hit, checks liveness over HTTP(S), and surfaces dead / takeover-prone names.

Inputs

Apex domain (example.com). No scheme required.

How to run it

  1. Open Security tools → Subdomain Finder (or go to /tool-subdomain-finder).
  2. Enter the root domain and click Scan Subdomains.
  3. Review the table: subdomain, IP, live/dead status, and discovery source.
  4. Export or feed live hosts into a full web scan or subdomain enumeration engagement scan for deeper coverage.

Output

List of {subdomain, ip, alive, status, source}. Public free-tool runs are rate-limited; signed-in users get higher limits and history.

Notes

  • Wildcard DNS is filtered so synthetic labels do not flood results.
  • This is the lightweight tool path. For WAF fingerprint + port enrichment + takeover checks as a first-class scan type, use Subdomain enumeration.
  • Only scan domains you are authorized to assess.
  • /scans/subdomain-enumeration/
  • /tools/dns-lookup/
  • /tools/waf-detector/

← Back to Security tools overview