The 2026 Subdomain Enumeration Tool Roundup
Ask ten different bug bounty hunters how they find subdomains, and you will get ten completely different bash scripts held together by duct tape and awk.
The reconnaissance phase dictates the success of a modern penetration test. If you miss a development server sitting on an obscure subdomain, you are leaving critical vulnerabilities (and bounties) on the table. But the landscape of OSINT and DNS enumeration tools is constantly shifting. Projects get abandoned, APIs change, and tools that were blazing fast three years ago are now bloated and slow.
In this roundup, we are cutting through the noise. Here are the five subdomain enumeration tools you actually need in your authorized testing workflow right now.
The Job to Be Done
Subdomain enumeration is not just about guessing words. It involves passive discovery (scraping APIs, Certificate Transparency logs, search engines) and active resolution (brute-forcing DNS records and verifying they resolve to live hosts).
We evaluated these tools based on three quick criteria:
- Speed & Concurrency: Can it handle massive datasets without hanging?
- API Integrations: Does it seamlessly connect with modern data sources (Shodan, Censys, SecurityTrails)?
- Maintenance: Is the GitHub repository actively maintained in 2026?
Here is the breakdown of the essential toolkit.
1. Subfinder
The undisputed king of fast, passive discovery.
Maintained by ProjectDiscovery, Subfinder is built in Go and designed for one thing: finding valid subdomains via passive online sources at blistering speeds. It doesn't brute-force DNS, making it completely stealthy. It queries over 40 different sources natively, and its modular architecture means you can easily plug in your API keys via a configuration file to unlock premium data sources.
When to reach for it: This should be the very first tool you run against any target. It establishes your baseline scope in seconds.
# Basic passive enumeration using Subfinder subfinder -d example.com -all -silent | tee subfinder_results.txt
2. OWASP Amass
The heavy-duty intelligence gatherer.
If Subfinder is a scalpel, Amass is a sledgehammer. Amass performs in-depth DNS enumeration, autonomous system (AS) discovery, and network mapping. It builds a localized graph database of everything it finds, allowing you to track changes over time and uncover deeply hidden infrastructure by linking relationships between domains, IPs, and ASNs.
When to reach for it: Use Amass for deep-dive, long-term engagements against large corporate infrastructures where you need to track assets continuously over several weeks. It is slower than Subfinder, but significantly more thorough.
# Run Amass in passive mode and output to a text file amass enum -passive -d example.com -o amass_results.txt
A modern reconnaissance pipeline: passive discovery feeds into active brute-forcing, ending with strict DNS resolution to eliminate false positives.
3. Puredns
The master of massive DNS resolution.
Passive discovery will only get you so far. To find dev and staging environments that aren't indexed anywhere, you must brute-force DNS using a wordlist. Puredns is a fast domain resolver and brute-forcing tool that accurately filters out wildcard subdomains and DNS poisoned entries using Massdns under the hood.
When to reach for it: After you have exhausted passive discovery, feed a massive wordlist into Puredns along with a list of reliable public resolvers to brute-force the remaining attack surface.
# Brute-force subdomains using a wordlist and resolve them to live hosts puredns bruteforce ~/wordlists/subdomains.txt example.com -r ~/resolvers.txt -w puredns_live.txt
4. Chaos (ProjectDiscovery)
The continuous dataset.
Chaos isn't a traditional command-line enumeration tool; it is a free dataset provided by ProjectDiscovery that continuously maps internet-wide public bug bounty programs. The Chaos client allows you to download these pre-compiled lists of subdomains directly to your terminal.
When to reach for it: When you are participating in a public bug bounty program and want a massive head start. You can download the entire known attack surface for a company instantly, bypassing the initial recon phase entirely.
# Download the latest known subdomains for a specific program chaos -d example.com -o chaos_subdomains.txt
5. Crt.sh (via curl/jq)
The purest form of Certificate Transparency.
While tools like Subfinder scrape Crt.sh automatically, sometimes you need direct, unadulterated access to Certificate Transparency (CT) logs without the overhead of a large Go binary. Writing a simple shell wrapper around the Crt.sh PostgreSQL interface or JSON API guarantees you are seeing exactly what SSL certificates have been issued for a domain.
When to reach for it: When you are scripting custom lightweight automation pipelines or when a primary tool's API parser breaks.
# Fetch subdomains directly from crt.sh and parse with jq curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u
Comparison Table
| Tool | Primary Use Case | Speed | Active Maintenance | Best Feature |
|---|---|---|---|---|
| Subfinder | Passive Discovery | Extremely Fast | Yes (ProjectDiscovery) | Seamless API integration |
| Amass | Deep Recon & Graphing | Slow / Moderate | Yes (OWASP) | Graph database tracking |
| Puredns | DNS Brute-forcing | Extremely Fast | Yes | Wildcard filtering |
| Chaos | Dataset Retrieval | Instant | Yes (ProjectDiscovery) | Pre-computed data |
| Crt.sh (API) | Certificate Transparency | Moderate | N/A | Raw SSL certificate data |
What I'd Actually Use
If I am spinning up a fresh bug bounty hunt today, I am not picking just one. The modern standard is a chained approach:
- Subfinder to instantly grab all passively known subdomains.
- Chaos to pull down historical data.
- Combine those lists, then use Puredns to actively resolve them and aggressively brute-force any gaps using a highly targeted wordlist.
Don't run these tools against infrastructure you don't own without explicit authorization. The noise generated by tools like Puredns is massive and will instantly flag SOC dashboards if run irresponsibly.
If you want to take your reconnaissance a step further, check out how we identify vulnerabilities on the endpoints you discover in our Modern Web Recon Workflow.
References / Further reading
- Subfinder GitHub Repository - ProjectDiscovery - https://github.com/projectdiscovery/subfinder
- OWASP Amass Project - OWASP - https://github.com/owasp-amass/amass
- Puredns GitHub Repository - d3mondev - https://github.com/d3mondev/puredns
- Chaos Dataset Project - ProjectDiscovery - https://chaos.projectdiscovery.io/
- Certificate Transparency Logs - crt.sh - https://crt.sh/
