Domain Discovery
Domain discovery allows you to add domain you know about (for instance,
example.com) and let us find subdomains and alternate TLDs (such as example.net).We use several methods to discover hostnames:
- 1.GuessingWe use a large database of potential subdomains and check whether they exist. This is also referred to as a brute force method. The checks are fast and light-weight so as to not overwhelm your DNS servers.
- 2.Databases & Public InformationWe use a variety of databases, certificate transparency logs, and other sources that contain subdomain records.
- 3.Third-party IntegrationsWe can easily integrate with your DNS servers like Amazon Route53, Azure, and Cloudflare to pull subdomains from your DNS records, or provide instructions for exporting a list from your DNS provider.
This process is run recursively, so if we discover
sub.example.com we'll use that to discover deeper subdomains, such as third.sub.example.com.We call the domains you add to discovery seed domains and you can add those from your dashboard or by sending a list or CSV to our team. By default, we use the domain on your email address to seed your account initially.
You can add new seed domains at any time on Discovery › Domain › Add. You'll see a list of suggested domains that are not currently included in your domain discovery.
You can remove domains from discovery by clicking the ✕ icon next to a domain on Discovery › Domain.
Each week we'll run our discovery process and compile discovered subdomains. You can also run the discovery process on demand by visiting Discovery › Domain and clicking the refresh icon in the row of the domain you'd like to run the process on.
All hosts found during the domain discovery process are reflected in the Discovery › Overview report. You can filter discovered targets in the source dropdown to see only ones discovered with domain discovery, or from a specific domain.
Last modified 11mo ago