Difference between revisions of "Finding subdomains"
Jump to navigation
Jump to search
m (Improve formatting) |
m (More formatting fixes) |
||
| Line 1: | Line 1: | ||
There are several ways to attempt to find subdomains for a given domain, such as example.com. | There are several ways to attempt to find subdomains for a given domain, such as example.com. | ||
# Perform web searches. The two primary search indexes are Bing and Google, and many other search engines use these indexes internally. Bing also has an API available. You can run queries as follows: Google: <code>site:example.com</code>. Bing: <code>site:example.com+</code> | # Perform web searches. The two primary search indexes are Bing and Google, and many other search engines use these indexes internally. Bing also has an API available. You can run queries as follows:<br/>Google: <code>site:example.com</code>.<br/>Bing: <code>site:example.com+</code> | ||
# Look for existing archived subdomains in the Internet Archive CDX (which also includes data from Common Crawl):<br/>Get page count: https://web.archive.org/cdx/search/cdx?url=*.example.com&collapse=original&fl=original&showNumPages=1<br/>Iterate through pages: https://web.archive.org/cdx/search/cdx?url=*.example.com&collapse=original&fl=original&page=0 | |||
# Look for existing archived subdomains in the Internet Archive CDX (which also includes data from Common Crawl): | |||
Get page count: https://web.archive.org/cdx/search/cdx?url=*.example.com&collapse=original&fl=original&showNumPages=1 | |||
Iterate through pages: https://web.archive.org/cdx/search/cdx?url=*.example.com&collapse=original&fl=original&page=0 | |||
# Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available. | # Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available. | ||
# Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list | # Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list | ||
# Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html | # Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html | ||
Revision as of 22:36, 2 January 2023
There are several ways to attempt to find subdomains for a given domain, such as example.com.
- Perform web searches. The two primary search indexes are Bing and Google, and many other search engines use these indexes internally. Bing also has an API available. You can run queries as follows:
Google:site:example.com.
Bing:site:example.com+ - Look for existing archived subdomains in the Internet Archive CDX (which also includes data from Common Crawl):
Get page count: https://web.archive.org/cdx/search/cdx?url=*.example.com&collapse=original&fl=original&showNumPages=1
Iterate through pages: https://web.archive.org/cdx/search/cdx?url=*.example.com&collapse=original&fl=original&page=0 - Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available.
- Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list
- Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html