> For the complete documentation index, see [llms.txt](https://notes.nomanaziz.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.nomanaziz.me/cybersecurity/penetration-testing/elearnsecurity/ejpt/information-gathering/subdomain-enumeration.md).

# Subdomain Enumeration

### dnsdumpster.com

utilizes data from google-indexed subdomains, bing and other sources.

Give sub domains, dns records and other information

***

### VirusTotal.com

It also caches websites dns records, subdomains etc.

***

### Crt.sh

It collects information about ssl records, from which we can extract subdomain details along with dns records.

***

### Sublist3r

Cli tool to collect dns data, subdomains, etc from various sources. Easily blocked by google.

***

### Amaas

Cli tool containing many features such as checking zone transfers, dns records, subdomains, bruteforce etc.

***