Subdomain discovery

Which hostnames exist under this domain?

Most of an organisation's attack surface lives on subdomains nobody remembers. Passive tools collect them from certificate transparency logs, search engines and DNS datasets. Active tools guess them by resolving wordlists.

Listed alphabetically. The order is not a ranking.

• OWASP AmassPassive and active modes

  Maps an organization's external attack surface from open sources, with optional zone transfers, certificate grabs and DNS brute force.

  15k stars · last push November 11, 2026 · v5.1.3 · Apache-2.0

• subfinderPassive

  Finds subdomains of a domain by querying passive online sources such as certificate logs and DNS datasets.

  15k stars · last push November 9, 2026 · v2.17.0 · MIT

• theHarvesterPassive and active modes

  OSINT collector that gathers hostnames, emails, IPs, URLs, ASNs and breach names for a domain from 66 public sources.

  18k stars · last push November 10, 2026 · 4.11.1 · GPL-2.0