Subdomains ¶

As explained in the DNS protocol, we use the term 'subdomain' to refer to the third-level domains and onward.

• www.example.com
• ftp.internal.example.com
• test.webapp.dev.example.com
• ...

Unlike vhosts, they are stored on a DNS server, which are often public, or accessible from the internal network to everyone.

Common tools to find subdomains are:

• gobuster
• ffuf
• DNSRecon
• dnsenum
• subbrute

Common wordlists are listed in wordlists#subdomains

• aquatone
• EyeWitness