Subdomains can be found through certificate transparency logs, passive DNS data, DNS queries, search indexes, public datasets and links discovered from known web properties. Reliable discovery combines several sources because no single dataset sees every hostname. Candidates should then be resolved, validated and attributed before they are added to the attack-surface inventory.
FAQ