To get all the subdomains of a domain I use the following command based on the assetfinder tools and massdns, both available on github. It is required to have git and python installed.
With git you clone the two github tools as detailed in each tool (in the case of assetfinder you can download a compilation for your OS version, there is a version for Windows), and they are obtained by executing, for example, the following, it is an executed example on linux Kali:
┌──(kali㉿kali)-[~/tools/massdns]
└─$ assetfinder --subs-only feitam.es | massdns -r $HOME/tools/massdns/lists/resolvers.txt -o S -w results.txt
Concurrency: 10000
Processed queries: 23
Received packets: 15
Progress: 100.00% (00 h 00 min 02 sec / 00 h 00 min 02 sec)
Current incoming rate: 9 pps, average: 7 pps
Current success rate: 7 pps, average: 6 pps
Finished total: 13, success: 13 (100.00%)
Mismatched domains: 1 (6.67%), IDs: 0 (0.00%)
Failures: 0: 46.15%, 1: 38.46%, 2: 7.69%, 3: 7.69%, 4: 0.00%, 5: 0.00%, 6: 0.00%, 7: 0.00%, 8: 0.00%, 9: 0.00%, 10: 0.00%, 11: 0.00%, 12: 0.00%, 13: 0.00%, 14: 0.00%, 15: 0.00%, 16: 0.00%, 17: 0.00%, 18: 0.00%, 19: 0.00%, 20: 0.00%, 21: 0.00%, 22: 0.00%, 23: 0.00%, 24: 0.00%, 25: 0.00%, 26: 0.00%, 27: 0.00%, 28: 0.00%, 29: 0.00%, 30: 0.00%, 31: 0.00%, 32: 0.00%, 33: 0.00%, 34: 0.00%, 35: 0.00%, 36: 0.00%, 37: 0.00%, 38: 0.00%, 39: 0.00%, 40: 0.00%, 41: 0.00%, 42: 0.00%, 43: 0.00%, 44: 0.00%, 45: 0.00%, 46: 0.00%, 47: 0.00%, 48: 0.00%, 49: 0.00%, 50: 0.00%,
Response: | Success: | Total:
OK: | 8 ( 61.54%) | 9 ( 60.00%)
NXDOMAIN: | 5 ( 38.46%) | 5 ( 33.33%)
SERVFAIL: | 0 ( 0.00%) | 0 ( 0.00%)
REFUSED: | 0 ( 0.00%) | 1 ( 6.67%)
FORMERR: | 0 ( 0.00%) | 0 ( 0.00%)
┌──(kali㉿kali)-[~/tools/massdns]
└─$ cat results.txt | grep -v 127.0.0
www.feitam.es. A 91.126.72.12
sftp.feitam.es. A 91.126.72.12
wiki.feitam.es. A 91.126.72.12
mail.feitam.es. A 91.126.72.12
feitam.es. A 91.126.72.12
┌──(kali㉿kali)-[~/tools/massdns]
└─$
The links to the tools on github are:
https://github.com/blechschmidt/massdnshttps://github.com/tomnomnom/assetfinder
