|Recon|[Amass](https://github.com/OWASP/Amass)|In-depth Attack Surface Mapping and Asset Discovery |![](https://img.shields.io/github/stars/OWASP/Amass?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[subfinder](https://github.com/projectdiscovery/subfinder)|Subfinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing. |![](https://img.shields.io/github/stars/projectdiscovery/subfinder?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[assetfinder](https://github.com/tomnomnom/assetfinder)|Find domains and subdomains related to a given domain |![](https://img.shields.io/github/stars/tomnomnom/assetfinder?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[Sub404](https://github.com/r3curs1v3-pr0xy/sub404)|A python tool to check subdomain takeover vulnerability|![](https://img.shields.io/github/stars/r3curs1v3-pr0xy/sub404?label=%20)|[`subdomains`](/categorize/tags/subdomains.md) [`takeover`](/categorize/tags/takeover.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[dmut](https://github.com/bp0lr/dmut)|A tool to perform permutations, mutations and alteration of subdomains in golang.|![](https://img.shields.io/github/stars/bp0lr/dmut?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[subjack](https://github.com/haccer/subjack)|Subdomain Takeover tool written in Go |![](https://img.shields.io/github/stars/haccer/subjack?label=%20)|[`subdomains`](/categorize/tags/subdomains.md) [`takeover`](/categorize/tags/takeover.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|
|Recon|[Sublist3r](https://github.com/aboul3la/Sublist3r)|Fast subdomains enumeration tool for penetration testers |![](https://img.shields.io/github/stars/aboul3la/Sublist3r?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Python](./images/python.png)](/categorize/langs/Python.md)|
|Recon|[findomain](https://github.com/Edu4rdSHL/findomain)|The fastest and cross-platform subdomain enumerator, do not waste your time. |![](https://img.shields.io/github/stars/Edu4rdSHL/findomain?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Rust](./images/rust.png)](/categorize/langs/Rust.md)|
|Recon|[subgen](https://github.com/pry0cc/subgen)|A really simple utility to concate wordlists to a domain name - to pipe into your favourite resolver!|![](https://img.shields.io/github/stars/pry0cc/subgen?label=%20)|[`subdomains`](/categorize/tags/subdomains.md)|![linux](./images/linux.png)![macos](./images/apple.png)![windows](./images/windows.png)[![Go](./images/go.png)](/categorize/langs/Go.md)|