Subdomain Enumeration Tools and Examples on Kali Linux

Subdomain enumeration expands a single domain into a list of hostnames attackers might probe next. After DNS enumeration maps nameservers and record types, subdomain tools pull historical OSINT or brute-force guesses to surface hosts you might miss in a manual review.

This guide installs five Kali packages and runs them against zonetransfer.me, a domain maintained for DNS and zone-transfer training. Every command and output below was captured on that authorized zone, not against random internet targets.

What is subdomain enumeration in ethical hacking?

The rest of this guide discovers hostnames under one apex domain before you port-scan or test web apps on those hosts. You are mapping attack surface, not exploiting services yet.

A subdomain is a hostname under a registered domain, such as www.example.com or vpn.example.com. Subdomain enumeration collects those names so you can feed them into Nmap, Burp Suite, or manual browsing during an engagement.

Common discovery methods overlap:

• Passive OSINT — certificate transparency, search engines, and threat-intel APIs (Subfinder, Assetfinder)
• DNS brute force — wordlist guesses resolved against public or target nameservers (massdns; Nmap dns-brute in DNS enumeration)
• Zone transfers — AXFR when a nameserver leaks the full zone (zonetransfer.me demos)
• Certificate and CT logs — crt.sh-style indexes surfaced by several passive tools

Passive tools do not send DNS queries to the target zone for every source, but they still describe the target to third-party services. Active brute force is visible in resolver and nameserver logs.

Kali lab setup

zonetransfer.me is a public training zone with many labeled subdomains and intentional misconfigurations. It is safer for classroom demos than scanning a random company domain.

Set variables once for every command below:

DOMAIN=zonetransfer.me
BRUTE_NS=nsztm1.digi.ninja
LAB=/tmp/subdomain-lab
mkdir -p "$LAB"

Build a short wordlist and resolver file for the massdns section later:

printf 'www\nmail\nftp\nowa\nstaging\n' > "$LAB/words.txt"
printf '8.8.8.8\n1.1.1.1\n' > "$LAB/resolvers.txt"

Install the enumeration packages if they are missing on your Kali image:

sudo apt update
sudo apt install -y subfinder assetfinder sublist3r massdns amass

Confirm the Subfinder build before you query passive sources:

subfinder -version 2>&1 | head -2

[INF] Current Version: v2.14.0
[INF] Subfinder Config Directory: /root/.config/subfinder

Version 2.14.0 matches the package row in the intro table. The tool sections below reuse DOMAIN and "$LAB" — only the enumeration program changes.

Compare subdomain enumeration tools

Use this table to pick a tool before you spend API quota or hammer a nameserver with brute-force guesses.

Combine at least two passive tools and one resolver-based pass on real engagements. Overlap is low enough that merged lists usually grow.

Enumerate subdomains with Subfinder

Subfinder queries configured passive sources and prints discovered hostnames. The -silent flag keeps output to one name per line for scripting.

Run a passive pass against the lab domain:

subfinder -silent -d "$DOMAIN"

Sample output (trimmed):

www.zonetransfer.me
staging.zonetransfer.me

Each line is a candidate hostname for your target spreadsheet. Subfinder did not prove the host is live today; it reported names seen in passive datasets. Follow with DNS resolution or HTTP probes on authorized targets.

Save results when you need a file for diffing or reporting:

subfinder -silent -d "$DOMAIN" -o "$LAB/subfinder.txt"

The command exits quietly on success when -silent is set. Confirm with wc -l "$LAB/subfinder.txt" before you merge into a master list.

Enumerate subdomains with Assetfinder

Assetfinder aggregates several public indexes in one command. The --subs-only flag drops the apex domain when you only want hostnames under the target.

List subdomains for the training zone:

assetfinder --subs-only "$DOMAIN"

Sample output (trimmed):

office.zonetransfer.me
email.zonetransfer.me
vpn.zonetransfer.me
owa.zonetransfer.me
staging.zonetransfer.me
www.zonetransfer.me

Assetfinder returned more names than Subfinder in this lab run because its source list differs. Merge unique lines from both tools before you declare enumeration complete.

Write the list to disk for later diffing:

assetfinder --subs-only "$DOMAIN" | tee "$LAB/assetfinder.txt"

Enumerate subdomains with Sublist3r

Sublist3r scrapes search engines and older OSINT modules. It remains on Kali for compatibility, but several modules break when sites change their HTML or block bots.

Run Sublist3r with ten threads against the lab domain:

sublist3r -d "$DOMAIN" -t 10 2>&1 | tee "$LAB/sublist3r.txt"

Sample output (trimmed):

[-] Searching now in Virustotal..
[!] Error: Virustotal probably now is blocking our requests
[!] DNSDumpster module failed: Could not find CSRF token on DNSDumpster page
[-] Total Unique Subdomains Found: 1
owa.zonetransfer.me

Sublist3r found owa.zonetransfer.me while VirusTotal and DNSDumpster failed. That is common on current Kali images. Keep Sublist3r as a supplemental pass, not your only passive source.

The Kali package installs /usr/bin/sublist3r. You do not need to clone the GitHub repository for the commands above.

Resolve subdomains with massdns

massdns resolves large hostname lists quickly through public or custom resolvers. It complements passive tools by confirming which guessed names answer in DNS today.

Build fully qualified names from the short wordlist:

sed 's/$/.'"$DOMAIN"'/' "$LAB/words.txt" > "$LAB/fqdns.txt"

Resolve those names through the resolver file:

massdns -r "$LAB/resolvers.txt" -t A -o S -w "$LAB/massdns-out.txt" "$LAB/fqdns.txt"

massdns prints a progress bar on stderr and finishes when every line in fqdns.txt is processed. Read the answers from the output file:

cat "$LAB/massdns-out.txt"

owa.zonetransfer.me. A 207.46.197.32
www.zonetransfer.me. A 5.196.105.14
staging.zonetransfer.me. CNAME www.sydneyoperahouse.com.

mail and ftp produced no lines because those names did not resolve during this run. The staging CNAME shows why you should follow aliases before you port-scan.

For brute-force against the training nameserver specifically, point Nmap dns-brute at BRUTE_NS with the same wordlist. massdns with public resolvers is enough for this walkthrough.

Enumerate subdomains with Amass

OWASP Amass maps attack surface through passive indexes, zone data, and optional brute-force modules. Kali ships Amass 5.x with a wrapper script that expects libpostal_data; call the binary directly when the wrapper fails.

Check the installed build:

/usr/lib/amass/amass -version

v5.1.1

Run a passive enumeration pass:

/usr/lib/amass/amass enum -passive -d "$DOMAIN"

Passive Amass can take a minute while it queries configured sources. In this lab run the session summary listed the apex zonetransfer.me while Subfinder and Assetfinder already returned multiple hostnames. Passive depth depends on API keys and enabled data sources.

If /usr/bin/amass prints libpostal_data: command not found, use /usr/lib/amass/amass for enum and intel subcommands until the wrapper is fixed on your image.

Troubleshooting

References

• OWASP Amass
• ProjectDiscovery Subfinder
• tomnomnom Assetfinder
• Sublist3r
• massdns
• Zone transfer training zone (Digi Ninja)

Summary

You installed Subfinder, Assetfinder, Sublist3r, massdns, and Amass on Kali and enumerated the authorized training zone zonetransfer.me. Subfinder reported www and staging; Assetfinder returned a longer passive list including owa and vpn; Sublist3r contributed owa while several legacy modules failed. massdns resolved www, owa, and a staging CNAME from a four-line wordlist.

Passive OSINT tools disagree because they query different third-party datasets. Merge and deduplicate hostname lists before you run port scans or web tests. Use massdns or Nmap DNS scripts when you need resolver-backed confirmation on nameservers you are allowed to query.

Run these workflows only on domains under authorization. Pair subdomain lists with network reconnaissance and banner grabbing on the hosts you discover, and build custom brute lists with a wordlist generator when you know naming patterns.