Subdomain Finder
Discover all subdomains for any domain using Certificate Transparency logs. See which are live and map your attack surface. No signup required.
What is Subdomain Enumeration?
Subdomain enumeration is the process of discovering all subdomains associated with a root domain. Organizations often have dozens or hundreds of subdomains: staging environments, API endpoints, admin panels, development servers, and legacy applications. Each subdomain represents a potential entry point for attackers. Mapping your full subdomain footprint is the first step in understanding your attack surface.
How Does This Tool Work?
This tool uses Certificate Transparency (CT) logs: a public, append-only record of every SSL/TLS certificate issued by trusted Certificate Authorities. When a certificate is issued for staging.example.com, it gets logged in CT. By searching these logs, we can discover subdomains without sending any traffic to the target.
- Passive reconnaissance: no requests sent to the target domain
- DNS resolution: each subdomain is checked to see if it's live
- IP address mapping: shows which IPs each subdomain resolves to
- Exportable results: copy the full list for your security assessment
Common Subdomain Security Risks
- Subdomain takeover: subdomains pointing to decommissioned cloud services (S3, Heroku, GitHub Pages) that attackers can claim
- Exposed staging/dev environments: environments with debug mode, default credentials, or weaker security
- Forgotten admin panels: legacy admin interfaces that may lack MFA or proper access controls
- Internal tools exposed publicly: Jenkins, Grafana, or database admin tools accessible from the internet
Frequently Asked Questions
What is Certificate Transparency?
Certificate Transparency is a public framework requiring Certificate Authorities to log all issued SSL/TLS certificates. These logs are searchable, allowing anyone to discover what certificates have been issued for a domain, and therefore what subdomains exist.
Is this scan legal?
Yes. This tool only queries publicly available Certificate Transparency logs and performs standard DNS lookups. No intrusive scanning or vulnerability testing is performed.
Why are some subdomains shown as "not resolving"?
A subdomain may appear in CT logs because a certificate was once issued for it, but the DNS record has since been removed. These "dead" subdomains can indicate subdomain takeover opportunities if they still point to a cloud service.
Is this tool free?
Yes, completely free with no signup required. For automated subdomain takeover detection and comprehensive vulnerability scanning across all your subdomains, try a free CyberOrbit assessment.