Advanced Recon: Taking Your Subdomain Discovery to the Next Level

Hello hackers, I’ve made up my mind to give back all the knowledge and methods I’ve learned from the community, straight back to the community.

If you’re considering a career as a full-time or part-time bug bounty hunter in 2025, now is the time to get on board. And fear not AI replacing your job. Let’s get started exploring the world of bug bounties and discovering some advanced techniques together!

Let’s go straight into the subject! Here, in this article, I will present various methods to find subdomains as well as tools and commands which can assist you in doing this. Once you are done reading this article, you will understand what subdomain discovery is and how to perform it efficiently. So, let’s begin!

1️⃣ DNS Brute-Forcing

Systematically tries subdomains with wordlists against DNS servers to find obscured subdomains.

— -

GoBuster — https://github.com/OJ/gobuster

gobuster dns -d google.com -w wordlists.txt

SubBrute — https://github.com/TheRook/subbrute

./subbrute.py google.com

2️⃣ Passive Reconnaissance

Utilizes publicly available resources such as `crt.sh`, search engine dorks, or WHOIS databases to find subdomains quietly without touching the target.

— -

Amass — https://github.com/owasp-amass/amass

amass enum -d google.com --config ~/.config/amass/config.yaml | cut -d" " -f1 | grep google.com | sort -u

* must use all free api keys *

Chaos— https://github.com/projectdiscovery/chaos-client

chaos -d google.com -key <chaos-apikey>

Subfinder — https://github.com/projectdiscovery/subfinder

subfinder -d google.com

* must use free api keys *

Subdominator— https://github.com/RevoltSecurities/Subdominator

 subdominator -d google.com -o output.txt

Assetfinder — https://github.com/tomnomnom/assetfinder

 assetfinder -subs-only google.com

Findomain — https://github.com/Findomain/Findomain

findomain -t google.com -q -r -u

SubDomainizer — https://github.com/nsonaniya2010/SubDomainizer

 python3 SubDomainizer.py -u google.com -san same -k -o output.txt

3️⃣ Active Scanning Tools

Utilizes tools such as `shuffledns`, `puredns`, and `subdominator` to proactively query DNS servers and APIs for subdomain discovery.

— -

PureDNS — https://github.com/d3mondev/puredns

puredns bruteforce wordlists.txt google.com --resolvers resolvers.txt

DnsBruter — https://github.com/RevoltSecurities/Dnsbruter

dnsbruter -d google.com -w wordlists.txt -c 150 -wt 80 -rt 500 -o output.txt

Shuffledns

shuffledns -d google.com -w n0kovo_subdomains_huge.txt -r resolvers.txt -o output.txt

4️⃣ Certificate Transparency Logs

Analyzes SSL certificate transparency data to identify subdomains tied to public certificates (e.g., using crt.sh or APIs)

— -

Crt.Sh

curl -s "https://crt.sh/?q=%25.google.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u

Riddler.io

curl -s "https://riddler.io/search/exportcsv?q=pld:google.com" | grep -Po "(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u

Whoisxmlapi

curl -s "https://subdomains.whoisxmlapi.com/api/v1?apiKey=<whoisxmlapi-key>&domainName=google.com" | jq -r '.result.records[].domain' | sort -u

jldc.me

curl -s "https://jldc.me/anubis/subdomains/google.com" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u

sonar.omnisint.io

curl --silent --insecure "https://sonar.omnisint.io/subdomains/google.com" | grep -oE "[a-zA-Z0-9._-]+\.$domain"

web.archive.org

curl -s "http://web.archive.org/cdx/search/cdx?url=*.google.com/*&output=text&fl=original&collapse=urlkey" | sort | sed -e 's_https*://__' -e "s/\/.*//" -e 's/:.*//' -e 's/^www\.//' | sort -u 

api.hackertarget.com

curl -s "https://api.hackertarget.com/hostsearch/?q=google.com" | grep -o "\w.*google.com" 

5️⃣ DNS Zone Transfers

Tries to do zone transfers (AXFR) to enumerate all DNS records, an exploit sometimes revealing subdomains.

— -

DNSRecon — https://github.com/darkoperator/dnsrecon

dnsrecon -d google.com -t axfr

Host — Built-in Linux tool

host -l google.com <nameserver>

Dig — Built-in Linux tool

dig ns example.com  #This will list the authoritative DNS servers.
dig axfr @<nameserver> example.com

Nmap

nmap --script=dns-zone-transfer -p 53 <nameserver>

6️⃣ Web Archives and Historical Data

Uses tools such as Wayback Machine to dig up old URLs and discover previously exposed subdomains. you can also use katana to find unique subdomains. and different assets.

7️⃣ Cloud-Based Discovery

Takes a scan of cloud providers such as AWS, Azure, or GCP for misconfigured or exposed subdomains (e.g., S3 buckets or blob storage).

CloudEnum — https://github.com/initstring/cloud_enum

️S3Scanner — https://github.com/sa7mon/S3Scanner

Lazys3 — https://github.com/nahamsec/lazys3

watch the video of Jason Haddix where he explain more about cloud based assets discovery in depth—

https://youtu.be/nGs8pWIj5k4?si=FYo27jO-fjH3DbPu

8️⃣ Reverse DNS Lookup

Discovers subdomains by doing reverse DNS lookups on IP ranges for the target.

Honestly I'm not doing this.

9️⃣ Virtual Host Scanning

Checks for subdomains by brute-forcing HTTP headers such as `Host` against the target server.

First, collect all of the subdomains and resolve them to their respective IPs. Remove any and all IP addresses belonging to CDNs. Utilize Intruder to fuzz hosts with IPs and also IPs with hosts, looking for any differing results. Use tools such as Gobuster and ffuf available online for further fuzzing and testing.

🔟 Using OSINT Tools

Takes advantage of open-source intelligence tools such as GitHub repositories, forums, and even leaked credentials to trace subdomains back to the target. use google dorks and bing dorks and other search engine.

github-search — https://github.com/gwen001/github-search

python3 github-subdomains.py -t <github-api-token> -d google.com | sort -u

These are some of the techniques I use on a day-to-day basis. If you liked this write-up, don’t forget to like and follow! You can also connect with me on Twitter if you have any questions or want to collaborate.

follow me on x —> h4xx00r

Thanks for Reading !!