dig that finds subdomains itself: one command, DNS info for every subdomain

From the thread · top comments

For almost all domains not under your control, the problem in your request is here: without supplying nor even knowing the names of all these subdomains If the server is not yours, you can only count on using a DNS request to communicate with it. The DNS query which might list which subdomains exist under a given domain is AXFR, and you can use dig for that: $ dig axfr example.org @ns.example.org but on almost all servers this is disabled for unauthorized users. I looked over Wikipedia's List of DNS record types and found no other request types which would involve information on subdomains whe

ChatGPT suggested that the crt.sh web service from Sectigo could help find many or most of the public subdomains of a given domain. I tried it out, and it does indeed seem to work, though it took some playing with and won't give you everything for some sites. Additionally, it allows you to download results as CSV or JSON, which is useful for processing with tools. So with some caveats (explained below), for many sites you can accomplish this with a small workflow: 1. crt.sh The crt.sh website allows you to search a list of their records of certificates, such as are used for HTTPS. This should