Free Subdomain Finder & Attack Surface Discovery
Discover all public and hidden subdomains associated with your domain. Uncover forgotten staging environments, unprotected developer APIs, and shadow IT assets before cybercriminals find them.
$ wesecurex-easm --enumerate-subdomains --target example.com
[FOUND] app.example.com -> 104.21.48.192 (Cloudflare CDN, TLS 1.3, Status: 200)
[FOUND] api.example.com -> 104.21.48.192 (REST API Gateway, TLS 1.3, Status: 200)
[FOUND] docs.example.com -> 76.76.21.21 (Vercel Edge, Status: 200)
[FOUND] mail.example.com -> 142.251.163.26 (Google Workspace MX)
[ATTENTION] dev-staging.example.com -> 54.211.89.12 (Direct AWS EC2, Exposed Port 8080)
[RESULT] Enumeration completed across 8 public intelligence sources in 1.4s
Reconnaissance Methodologies Used
Certificate Transparency (CT)
Inspects public cryptographic logs from DigiCert, Let's Encrypt, Cloudflare, and Sectigo to uncover newly issued certificates.
Passive DNS Datasets
Leverages historical DNS resolutions from global ISP recursive resolvers to map legacy hostnames.
Web Crawling & Robots.txt
Extracts subdomains referenced in sitemaps, robots.txt disallow rules, and JavaScript bundle source maps.
DNS Brute-Force & Wordlists
Tests thousands of high-probability prefixes (api, dev, test, stage, v1, admin) against authoritative nameservers.
Upgrade from Single-Check to External Attack Surface Reconnaissance (EASM)
24/7 continuous discovery of subdomains, open ports, and shadow IT. Scale with automated schedules, Slack alerts, 150+ monthly credits, and compliance PDF exports on our paid tiers.
Frequently Asked Questions
How does passive subdomain enumeration work without alerting the target?
Passive enumeration queries external publicly accessible databases - such as Certificate Transparency (CT) logs, search engine indexes, DNS archives, and Threat Intelligence APIs. Because no network packets or DNS requests are sent directly to the target servers, passive discovery produces zero noise in server logs.
Why are forgotten subdomains (Shadow IT) dangerous?
Developers frequently create staging subdomains (e.g., 'staging-api.example.com', 'test-app.example.com', 'dev.example.com') to test features. These subdomains often lack firewalls, WAF rules, multi-factor authentication, or software updates, providing attackers with an easy vector to access production databases.
What is Certificate Transparency (CT) logging?
Certificate Transparency is an open framework mandated by Google and Apple where Certificate Authorities must log every issued SSL/TLS certificate to publicly auditable, tamper-evident append-only logs. Querying CT logs reveals newly provisioned subdomains within minutes of certificate creation.
How does WeSecureX automate continuous subdomain discovery?
WeSecureX Surface Recon polls Certificate Transparency logs in real-time. Whenever an engineer creates a new SSL certificate for any subdomain under your root domain, WeSecureX automatically triggers security posture scans, port checks, and vulnerability scans immediately.