__________
| CRT |
| ________|_
| | SSL |
| | ________|_
| | | HTTPS | ______|\ subdomain1.target.com
|_| | | | \ subdomain2.target.com
| | | | \ subdomain3.target.com
|_| | | / subdomain4.target.com
| | |______ / subdomain5.target.com
|__________| |/ subdomain6.target.com
Passive scan to find subdomains by searching public records
Example of use: ./subdomainfinder.sh target.com
- crt.sh
- bufferover (The API requires a valid api-key, you can get one for free directly in the website)
- subdomainfinder
- DNSdumpster
The tool will create temporary files in the execution directory that will be removed after scanning ends
SubdomainFinder is licensed under the GNU General Public License version 3 (GNU GPL v3).