How to Find All Subdomains of Any Website (Free, No Install)
Subdomains often expose forgotten staging servers, old admin panels and misconfigured services. Whether you're a bug bounty hunter, a sysadmin auditing your own domain, or an SEO checking site structure, the first step i
Subdomains often expose forgotten staging servers, old admin panels and misconfigured services. Whether you're a bug bounty hunter, a sysadmin auditing your own domain, or an SEO checking site structure, the first step is knowing which subdomains exist.
Why subdomain enumeration matters
- Security: forgotten subdomains are a common source of takeovers and leaks.
- Asset inventory: teams often don't know everything they've deployed.
- SEO: duplicate or stale subdomains can split your search rankings.
Method 1: Use a free online tool
The fastest way is a browser-based tool like Manamil Subdomain Finder:
- Open the tool and type the domain (e.g.
example.com). - Run the search.
- Review the results: each subdomain shows whether it's live, its IP address, hosting country and first-seen date.
The live-status column is the useful part: you can immediately focus on the subdomains that actually respond.
Method 2: Command-line tools
If you prefer the terminal, tools like subfinder and amass are popular open-source options. They're powerful but need installation and setup.
What to do with the results
- Check dead subdomains whose DNS still points somewhere (takeover risk).
- Run an SSL check on live ones.
- Look up ownership with a WHOIS lookup and verify records with a DNS checker.
- Remove or redirect anything you no longer use.
Only scan what you're allowed to
Enumerate your own domains or targets within a bug bounty program's scope.
Got a favourite recon workflow? Share it in the comments.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.