.png&w=256&q=75){kind=small}
Subdomain Finder & DNS EnumerationVulnerabilityScanner
Continuous offensive security and exposure management for web applications, networks, APIs, and cloud infrastructure.
12M+
Paths tested daily
800+
Curated wordlists
99.1%
Uptime SLA
< 2s
Avg. first hit
50K+
Security teams
SOC 2 II
Certified
Enumerate subdomains with 110K+ wordlist entries
Systematically query DNS resolvers for every entry in our curated wordlist corpus derived from real-world subdomain data across millions of domains. Wildcard detection and response deduplication eliminate noise automatically.
Find hidden paths and endpoints with
documented evidence
Our fuzzer doesn't just list paths it captures the full HTTP response, annotates the risk level, and presents each discovery with complete evidence so your team can act immediately.
Every attack surface, fully fuzzed
Our scanner probes every dimension of your web infrastructure using purpose-built wordlists for each attack category.
Directory Bruteforce
Enumerate hidden directories using 4,000+ common path patterns across all popular frameworks.
Parameter Fuzzing
Discover undocumented GET/POST parameters, debug flags, and hidden API fields.
Virtual Host Discovery
Find hidden subdomains and VHosts co-located on the same IP address.
Extension Scanning
Test every path with .bak, .old, .sql, .zip, .log, .conf and 80+ more extensions.
Backup File Detection
Locate exposed database dumps, code backups, and archive files left on public paths.
API Endpoint Discovery
Surface undocumented REST and GraphQL endpoints using API-specific wordlists.
Admin Panel Detection
Identify admin, management, and CMS login interfaces across all popular platforms.
Config File Exposure
Detect exposed .env, .htaccess, web.config, and application configuration files.
DNS resolution validation
Every discovered subdomain is resolved against 8 independent public DNS resolvers. Only subdomains that return a consistent A, AAAA, or CNAME record appear in your results.
Wildcard DNS detection & filtering
Before bruteforcing, SubScan probes with a random subdomain to fingerprint wildcard responses. Wildcard matches are automatically filtered your results contain only genuine subdomains.
Internal IP exposure flagging
Subdomains that resolve to RFC 1918 private addresses (10.x, 172.16.x, 192.168.x) are automatically flagged a common sign of misconfigured split-horizon DNS exposing internal services.
Trust Your Results.
Validate Every Subdomain
Every subdomain in your report is DNS-resolved, wildcard-filtered, and HTTP-probed. If it appears in your results, it's live, real, and confirmed not a false positive from a wildcard catch-all.
See it in actionSample
Subdomain
Discovery
Report
This sample report shows what you receive after every scan the discovered subdomains, their sources, resolved IPs, risk classification, and remediation guidance.
Download sample reportAn at-a-glance summary total subdomains found, source breakdown, risk distribution, and critical internal exposures.
From domain to report fully automated
Enter Domain
Type any public domain. No install, no setup just the domain name and a click.
Query CT Logs
We instantly mine CT logs for all subdomains that have ever had a TLS certificate.
DNS & OSINT
Bruteforce + passive OSINT runs in parallel across 10+ sources simultaneously.
Resolve & Probe
All subdomains are DNS-resolved and HTTP-probed. Wildcards filtered automatically.
Export Report
One-click export to PDF, JSON, or CSV export. Push directly to Jira, Linear, or Github Issues.
Use this tool from your command line interface
If you prefer it, we also provide a CLI version of our Website Vulnerability Scanner. Through the ScanCore CLI, you can run scans against your web apps and start gathering insights for your next move.
1. Installation
If you have docker or pip installed, you can use them to get scancore:
2. Usage
Quickstart: run the following command in your terminal to find the vulnerabilities of your website.
You can learn more options with the --help flag:
Frequently asked questions
Everything you need to know before your first scan.
Yes. Scans are non-destructive and rate-limited by default, and any payload that could have side effects runs through sandboxed proof-of-concept validation instead of against your live system, so normal traffic and uptime are unaffected.