---
id: 3347
title: "Discovering Subdomains"
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/discovering-subdomains/"
published_at: "2016-05-26T00:00:00Z"
tags: ["bug-bounty", "reconnaissance", "shodan", "subdomain-discovery", "google-dorks", "crt-sh"]
phying_url: "https://phying.com/item/3347"
lang: en
---

# Discovering Subdomains

## Summary

A bug hunter's guide to subdomain discovery on wildcard scopes: combining Google dorks, VirusTotal, DNSDumpster, crt.sh certificate transparency and Shodan beats any single technique.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2016-05-26T00:00:00Z
- **Original:** https://www.bugcrowd.com/blog/discovering-subdomains/
- **Phying News:** https://phying.com/item/3347