> For the complete documentation index, see [llms.txt](https://security.navidnaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.navidnaf.com/dark-magic/reconnaissance/passive/subdomain.md).

# Subdomain

A **subdomain** is a part of a larger domain name that allows for the organization and separation of different sections or services of a website. For example, in `blog.example.com`, "blog" is the subdomain, while "example.com" is the main domain. Subdomains are often used to host different parts of a site, like **mail.example.com** for email services or **shop.example.com** for an online store.

## Sublist3r

**Sublist3r** is a tool designed for **subdomain enumeration**. It leverages **OSINT (Open Source Intelligence)** to gather subdomains of a target domain without direct interaction, meaning it doesn't brute-force subdomains unless specified. Instead, it collects information from various search engines and public sources like Google, Bing, VirusTotal, and others to identify subdomains.

* **OSINT-based Enumeration**: It gathers subdomains from publicly available data, reducing the chance of detection by the target.
* **Brute-force Support**: While it primarily uses OSINT, Sublist3r also supports brute-forcing subdomains using a wordlist, if needed.

```
git clone https://github.com/aboul3la/Sublist3r.git
cd Sublist3r
sudo pip install -r requirements.txt

# Usage
python sublist3r.py -d [DOMAIN]
```

{% embed url="<https://github.com/aboul3la/Sublist3r>" %}