_noob.tools
My IP
Return to Matrix Dashboard

DNS Map (Subdomain Discovery)

Aggressively discovers internal, staging, and hidden subdomains using a hybrid engine: passively mining Certificate Transparency logs (OSINT) globally, whilst simulating a highly concurrent local dictionary attack against top corporate footprints.

What is the DNS Subdomain Mapper?

This finds subdomains belonging to a target domain by pulling historical names from public certificate logs and testing a list of common hostnames, then checks which ones actually resolve today.

How it works

The server queries crt.sh and HackerTarget's host-search API for subdomains that have ever appeared in an issued SSL certificate, and separately looks up the domain's own NS, MX, and TXT records over DNS-over-HTTPS. It then combines those names with a fixed list of roughly 90 common prefixes (vpn, admin, staging, sso, and similar) and resolves all of them in small concurrent batches, marking each as live or dead based on whether a DNS lookup returns an IP.

SysAdmin & security use cases

  • Turn up a staging or dev API that was never meant to be public.
  • See a domain's mail and VPN infrastructure at a glance via its MX and NS records.
  • Spot subdomains pointing at services nobody remembers signing up for.
  • Build a starting list of live hosts before a more targeted security review.