matthernet / SubdomainFinder

Find subdomains by searching public certificate records

     __________
    | CRT      |
    |  ________|_
    | | SSL      |
    | |  ________|_
    | | | HTTPS    |    ______|\    subdomain1.target.com
    |_| |          |   |        \   subdomain2.target.com
      | |          |   |         \  subdomain3.target.com
      |_|          |   |         /  subdomain4.target.com
        |          |   |______  /   subdomain5.target.com
        |__________|          |/    subdomain6.target.com

SubdomainFinder

Description

Passive scan to find subdomains by searching public records

Usage

Example of use: ./subdomainfinder.sh target.com

Sources

• crt.sh
• bufferover (The API requires a valid api-key, you can get one for free directly in the website)
• subdomainfinder
• DNSdumpster

Notice:

The tool will create temporary files in the execution directory that will be removed after scanning ends

Licensing:

SubdomainFinder is licensed under the GNU General Public License version 3 (GNU GPL v3).