Tools

Generates subdomain permutations and alterations from a wordlist of common patterns (dev, staging, api-v2) and resolves the results.

altdns -i subdomains.txt -o data_output -w words.txt -r -s results.txt

OWASP in-depth attack-surface mapping tool: DNS enumeration, subdomain discovery via dozens of passive sources, and network-mapping graph output.

amass enum -passive -d example.com -o subdomains.txt

Team Cymru's whois service answers an IP's ASN, prefix, country and registry in a single query, with no API key required.

whois -h whois.cymru.com " -v 1.1.1.1"

Small Go tool that finds domains and subdomains related to a given domain from a handful of free sources — a lightweight complement to heavier enumerators.

assetfinder --subs-only example.com

A quick parallel PTR sweep across a /24 without needing a dedicated scanner installed.

for i in $(seq 1 254); do host 10.10.10.$i & done 2>/dev/null | grep -v 'not found'

Resolves a large subdomain candidate list against a set of trusted public resolvers far faster than looping dig/host over each name.

massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt

Dataset and API of continuously-crawled subdomain data for public bug-bounty-in-scope domains, maintained by ProjectDiscovery and queryable via their CLI.

chaos -d example.com -silent

A free, searchable front-end over Certificate Transparency logs — the fastest way to enumerate every subdomain that has ever had a public TLS certificate issued for it.

curl -s 'https://crt.sh/?q=%.target.tld&output=json' | jq -r '.[].name_value' | sort -u

Certificate transparency search engine indexing CT logs for domain and subdomain discovery, with a faster/more filterable UI than crt.sh for large result sets.

A configurable DNS proxy for penetration testers — redirects specific domains to attacker-controlled infrastructure, the DNS half of a phishing or MITM lab setup.

dnschef --fakeip 10.10.14.7 --fakedomains target.tld

Free web-based domain research tool that maps a domain's DNS records, subdomains and hosting relationships, with a graphical network map.

A classic Perl DNS enumeration tool — zone transfers, MX/NS/A record lookups, Google scraping for subdomains and brute-force, bundled into one script that predates most of the newer Go-based DNS tools.

dnsenum example.com

Reverse-lookup service for Google Analytics/AdSense IDs, nameservers and shared IPs — surfaces other domains run by the same operator even when WHOIS is hidden.

A Python DNS enumeration and reconnaissance tool covering standard record enumeration, zone transfers, SRV record checks, reverse lookups over a range and Google/Bing subdomain scraping in one tool.

dnsrecon -d example.com -t std,brt

Generates and checks likely typosquatted, homoglyph and bit-flipped variations of a domain name — the standard tool for detecting phishing/brand-impersonation domains registered against a company before a takedown is needed.

dnstwist --registered example.com

Visualises and diagnoses a domain's DNS and DNSSEC delegation chain — spots misconfigurations that would otherwise show up only as intermittent, hard-to-explain resolution failures.

A fast, multi-purpose DNS toolkit from ProjectDiscovery — bulk resolution, wildcard filtering and record-type querying built for piping into and out of the rest of that project's recon tool chain.

subfinder -d example.com | dnsx -a -resp

Modern command-line DNS client with colourised, readable output and DNS-over-HTTPS/TLS support, a friendlier drop-in for everyday dig usage.

dog example.com MX @1.1.1.1

Command-line DNS client supporting DoH, DoT and DoQ with human-readable, colourised output — similar niche to dog, written in Go.

doggo example.com @https://1.1.1.1/dns-query

Historical passive-DNS database (the former Farsight DNSDB) that tracks every observed DNS record over time, used to see what a domain resolved to in the past.

WHOIS lookup and historical WHOIS record database, widely used for domain ownership research and infrastructure attribution even after WHOIS privacy became the default.

Pulls every certificate-transparency-logged hostname for a domain straight from crt.sh's JSON API, no browser needed.

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r ".[].name_value" | sort -u

RDAP is the structured-JSON successor to WHOIS; rdap.org routes the query to the right registry and hands back machine-readable output.

curl -s https://rdap.org/domain/example.com | jq ".events, .entities"

A DNS reconnaissance tool that locates non-contiguous IP space and hostnames against a target domain — zone transfer attempts, wordlist-based subdomain brute-forcing and reverse lookups to map a domain's DNS footprint.

fierce --domain example.com

Fast Rust subdomain enumerator that queries certificate-transparency logs and multiple passive-DNS APIs, with an optional monitoring mode for new subdomains.

findomain -t example.com -o

Subdomain-permutation generator similar in purpose to altdns, with adjustable permutation depth and its own wordlist format.

gotator -sub subdomains.txt -perm permutations.txt -depth 1 -numbers 3

One loop instead of six separate dig invocations when you want the full picture of a domain's A/AAAA/MX/TXT/NS/SOA/CNAME records.

for t in A AAAA MX TXT NS SOA CNAME; do echo "== $t =="; dig +short example.com "$t"; done

Looks up an ASN's announced prefixes, peers and reverse-DNS in-bulk, a go-to reference for understanding whose network address space actually belongs to.

Checks a domain's DNS and mail-server configuration for common mistakes (missing glue, lame nameservers, SOA issues) and grades the result.

IP geolocation and ASN lookup API/website, commonly wired into recon scripts for a quick org/location answer on an IP list.

curl -s ipinfo.io/1.1.1.1

Simple bulk IP-to-ASN lookup service with a downloadable dataset, useful when you need to tag a large IP list with owning ASN offline.

A high-performance bulk DNS resolver — designed to resolve millions of domain names against a list of resolvers in a fraction of the time a per-query tool would take, the workhorse underneath most large-scale DNS enumeration tooling.

massdns -r resolvers.txt -t A -o S -w results.txt domains.txt

Suite of DNS and mail diagnostic lookups — MX records, DNSBL blacklist status, SPF/DKIM/DMARC validation — in one dashboard.

A domain's hosting history in one report — IP history, hosting provider changes, detected technology and a risk rating, often used to attribute infrastructure moves.

In-depth attack-surface mapping and asset discovery — combines passive DNS/certificate-transparency sources with active DNS enumeration to build a graph of an organisation's external footprint, used defensively to find shadow-IT assets before an attacker does.

amass enum -d example.com

Network-wide DNS sinkhole — blocks ads and known-malicious domains at resolution time, and its query log doubles as a lightweight DNS monitoring/visibility tool for a home or small office network.

pihole -q malicious-domain.com   # check if/why a domain is being blocked

Wraps massdns for reliable bulk DNS resolving and subdomain brute-forcing, with automatic wildcard detection so a wildcard DNS record does not flood results with false positives.

puredns bruteforce wordlist.txt example.com -r resolvers.txt

The structured-JSON successor to WHOIS; rdap.org routes a query to the correct registry and returns machine-parseable output instead of free-text WHOIS.

Walks every address in a range and runs a PTR lookup on each, a fast way to spot hostnames that hint at a network's internal layout.

for ip in $(prips 10.0.0.0/24); do dig +short -x "$ip"; done

Finds netblocks and ASNs registered to a company name before subdomain enumeration even starts, using Amass's intel gathering rather than its enum mode.

amass intel -org "Example Inc"

RIPE NCC's tool for exploring routing history, WHOIS and geolocation data for any IP, prefix or ASN, backed by RIPE's own registry and RIS routing data.

Free tier of Microsoft's threat-intel platform (formerly RiskIQ PassiveTotal) offering passive DNS, WHOIS history and certificate data for infrastructure investigations.

Historical and current DNS/WHOIS intelligence platform — passive DNS history, IP neighbor lists and subdomain data, popular for infrastructure attribution.

ProjectDiscovery wrapper around massdns for subdomain brute-forcing and resolution, built to plug into the rest of their recon toolchain.

shuffledns -d example.com -w wordlist.txt -r resolvers.txt

ProjectDiscovery's fast passive subdomain enumeration tool, pulling from dozens of public sources and APIs; built to pipe cleanly into the rest of their toolchain.

subfinder -d example.com -all -o subs.txt

delv (shipped with BIND) walks the DNSSEC chain from the root down and reports exactly where validation succeeds or breaks, which dig alone won't show.

delv +rtrace example.com

Free suite of small DNS/network lookup tools — reverse WHOIS, reverse IP, DNS history, port scan — useful when you need one quick answer without standing up your own tooling.

Checks DNS record propagation for a domain across dozens of resolvers worldwide, useful for confirming whether a change has actually gone global yet.

Bulk and reverse WHOIS lookup service — finds every other domain registered with the same email address or registrant name.

A DNS and DNSSEC health-check tool developed by .SE and AFNIC — runs dozens of correctness and best-practice tests against a domain's DNS delegation and reports misconfigurations before they cause an outage or a security gap.