A curated collection of tools, references, RFCs, open-source projects, and learning materials for subdomain enumeration, DNS security, and attack surface management.
The OWASP Amass project performs network mapping and external asset discovery using open source information gathering and active reconnaissance techniques. One of the most comprehensive open-source subdomain enumeration tools available, with support for passive APIs, active DNS, and graph database storage.
github.com/owasp-amass/amassA fast passive subdomain discovery tool from ProjectDiscovery. It uses passive sources such as search engines, DNS datasets, and certificate logs to find subdomains without sending traffic to the target. Highly configurable with support for dozens of API sources and excellent performance on large scopes.
github.com/projectdiscovery/subfinderA popular Python-based subdomain enumeration tool that uses search engines (Google, Yahoo, Bing, Baidu) and services like Netcraft, VirusTotal, and DNSdumpster to discover subdomains. Simple to use with a straightforward command-line interface. Great for quick passive enumeration.
github.com/aboul3la/Sublist3rA high-performance DNS stub resolver for bulk lookups and reconnaissance. MassDNS can resolve millions of domain names per hour using multiple public resolvers. Often used as a DNS resolution backend for other enumeration tools to verify brute-forced subdomain candidates at scale.
github.com/blechschmidt/massdnsA fast, customizable vulnerability scanner from ProjectDiscovery. While not a subdomain tool itself, Nuclei is commonly used after subdomain enumeration to scan discovered subdomains for vulnerabilities, including subdomain takeover signatures across dozens of cloud providers.
github.com/projectdiscovery/nucleiA comprehensive DNS enumeration script written in Python. Supports standard record enumeration, zone transfer testing, reverse lookups, Google dork queries, zone walking, and brute-force enumeration. One of the oldest and most battle-tested DNS reconnaissance tools in the security community.
github.com/darkoperator/dnsreconThe foundational RFC that defines the domain name system architecture, including the concept of domains, subdomains, name servers, and resolvers. Essential reading for anyone working with DNS at a fundamental level.
The companion specification to RFC 1034 that defines the protocol details of DNS, including message format, transport, name server algorithms, and resource record types. The technical foundation of all DNS tools and resolvers.
Defines the Certificate Transparency framework that requires CAs to publicly log all issued certificates. This RFC enables the CT-based subdomain discovery technique used by SubDoms and many other security tools.
The DNS Security Extensions RFCs that define how DNS responses can be cryptographically signed to prevent spoofing and cache poisoning. Understanding DNSSEC is important for assessing the security posture of discovered subdomains.
A free Certificate Transparency search engine maintained by Sectigo. Query any domain to see all SSL/TLS certificates that have been issued for it and its subdomains. One of the most valuable passive subdomain discovery resources available.
crt.shA comprehensive DNS data provider offering historical DNS records, subdomain enumeration, and WHOIS history. Provides API access for integrating DNS intelligence into security workflows. Used by many organizations for threat intelligence.
securitytrails.comA free DNS reconnaissance tool from HackerTarget. Provides subdomain discovery, DNS records, and a visual map of the DNS topology. Useful for quick assessments and educational purposes. Limits apply to free usage.
dnsdumpster.comThe OWASP Testing Guide chapter on information gathering covers DNS enumeration techniques as part of web application penetration testing. A practical guide for security testers that puts subdomain discovery in the context of a complete security assessment methodology.
A community-maintained list of services vulnerable to subdomain takeover. Documents the fingerprints, CNAME patterns, and verification steps for over 80 cloud services. Essential reference for anyone performing subdomain takeover testing.
github.com/EdOverflow/can-i-take-over-xyz