WebHackersWeapons/categorize/tags/subdomains.md

## Tools for subdomains

| Type | Name | Description | Star | Tags | Badges |
| --- | --- | --- | --- | --- | --- |
|Recon|[Amass](https://github.com/OWASP/Amass)|In-depth Attack Surface Mapping and Asset Discovery |![](https://img.shields.io/github/stars/OWASP/Amass?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[subfinder](https://github.com/projectdiscovery/subfinder)|Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. |![](https://img.shields.io/github/stars/projectdiscovery/subfinder?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[assetfinder](https://github.com/tomnomnom/assetfinder)|Find domains and subdomains related to a given domain |![](https://img.shields.io/github/stars/tomnomnom/assetfinder?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[Sub404](https://github.com/r3curs1v3-pr0xy/sub404)|A python tool to check subdomain takeover vulnerability|![](https://img.shields.io/github/stars/r3curs1v3-pr0xy/sub404?label=%20)|[`subdomains`](/categorize/tags/subdomains.md) [`takeover`](/categorize/tags/takeover.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[subzy](https://github.com/LukaSikic/subzy)|Subdomain takeover vulnerability checker|![](https://img.shields.io/github/stars/LukaSikic/subzy?label=%20)|[`subdomains`](/categorize/tags/subdomains.md) [`takeover`](/categorize/tags/takeover.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[knock](https://github.com/guelfoweb/knock)|Knock Subdomain Scan |![](https://img.shields.io/github/stars/guelfoweb/knock?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Python](./images/python.png)](/categorize/langs/Python.md)|
|Recon|[dmut](https://github.com/bp0lr/dmut)|A tool to perform permutations, mutations and alteration of subdomains in golang.|![](https://img.shields.io/github/stars/bp0lr/dmut?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[subs_all](https://github.com/emadshanab/subs_all)|Subdomain Enumeration Wordlist. 8956437 unique words. Updated. |![](https://img.shields.io/github/stars/emadshanab/subs_all?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)|
|Recon|[subjack](https://github.com/haccer/subjack)|Subdomain Takeover tool written in Go |![](https://img.shields.io/github/stars/haccer/subjack?label=%20)|[`subdomains`](/categorize/tags/subdomains.md) [`takeover`](/categorize/tags/takeover.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[Sublist3r](https://github.com/aboul3la/Sublist3r)|Fast subdomains enumeration tool for penetration testers |![](https://img.shields.io/github/stars/aboul3la/Sublist3r?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Python](./images/python.png)](/categorize/langs/Python.md)|
|Recon|[findomain](https://github.com/Edu4rdSHL/findomain)|The fastest and cross-platform subdomain enumerator, do not waste your time. |![](https://img.shields.io/github/stars/Edu4rdSHL/findomain?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Rust](./images/rust.png)](/categorize/langs/Rust.md)|
|Recon|[subgen](https://github.com/pry0cc/subgen)|A really simple utility to concate wordlists to a domain name - to pipe into your favourite resolver!|![](https://img.shields.io/github/stars/pry0cc/subgen?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[SubOver](https://github.com/Ice3man543/SubOver)|A Powerful Subdomain Takeover Tool|![](https://img.shields.io/github/stars/Ice3man543/SubOver?label=%20)|[`subdomains`](/categorize/tags/subdomains.md) [`takeover`](/categorize/tags/takeover.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|