Subdomain Scanner
Simulate domain asset enumeration to identify potential dev, staging, or api subdomains belonging to a target host.
This interactive client-side tool is part of the NervLink Cybersecurity Suite. All analysis is verified entirely inside the local browser sandbox for maximum safety and data privacy compliance.
How It Works
- Enter a root domain name (e.g. example.com) in the input field.
- The scanner enumerates over 80 common subdomain prefixes (www, api, dev, staging, admin, mail, cdn, etc.) using DNS A record lookups.
- Each candidate subdomain is resolved via secure Cloudflare DNS-over-HTTPS API. Subdomains that resolve to valid IP addresses are reported as discovered assets.
- Results are displayed in a sortable table with resolved IPs and TTL values, with options to copy or export as CSV.
Primary Use Cases
- Discovering hidden development, staging, or admin panels that may be exposed to the public internet.
- Attack surface mapping during penetration testing engagements to identify all publicly accessible subdomains.
- Asset inventory verification for organizations to ensure no unauthorized subdomains exist on their domains.
- Bug bounty reconnaissance to find overlooked subdomains that may contain vulnerabilities.
Common Security Pitfalls
- Assuming that only 'www' is the active subdomain — many organizations run dozens of subdomains including api, dev, staging, and internal tools.
- Not checking subdomains periodically — forgotten staging or test subdomains are a common attack vector for data breaches.
- Relying solely on automated prefix lists — some subdomains use custom naming conventions that require additional techniques like certificate transparency log analysis.
Frequently Asked Questions
- How does the subdomain finder discover subdomains?
- The tool checks common subdomain prefixes (like www, api, mail, dev, staging) by performing DNS A record lookups. If a subdomain resolves to an IP address, it is reported as an active, discovered asset.
- Is subdomain scanning legal?
- DNS lookups are public queries and generally legal. However, actively probing or scanning discovered subdomains for vulnerabilities without authorization may violate laws. Always obtain proper authorization before conducting security assessments.
- Can this tool find all subdomains of a domain?
- This tool checks the most common subdomain prefixes. For exhaustive enumeration, security professionals also use certificate transparency logs, brute-force wordlists, and passive DNS databases.
- Does the scan send any data to a server?
- The subdomain resolution queries are performed via secure DNS-over-HTTPS API calls. No domain data is stored or logged on our servers.
References & Standards