Overview
The Domain Finder discovers additional domain names owned by a target organization. These associated domains may expose resources that are less secure than the main domain, making domain discovery a useful step during penetration tests and bug bounty activities.
Domain Finder is a discovery tool: it identifies related domains but does not test for vulnerabilities. It does not add data to your Attack Surface or generate findings.
Example: For facebook.com, the tool discovers related domains like:
facebook.netfbcdn.netfb.commessenger.comfbsbx.com
Scan types
Custom scan allows you to select which techniques to use and configure all parameters manually.
Parameters
| Parameter | Description |
|---|
| Target | The target domain (e.g., oracle.com, yahoo.com). Must be a root domain with a TLD, subdomains like www.example.com are not accepted. |
| Scan type | Light, Deep, or Custom. See comparison table above. |
| SSL Certificates | Enable searching Certificate Transparency Logs. See SSL Certificates for details. |
| BuiltWith | Enable searching for shared technology relationships. See BuiltWith for details. |
| Reverse Whois | Enable reverse Whois lookups on registrant data. See Reverse Whois for details. |
| Minimum weight | Certainty threshold (0-100) for including a domain in results. Default is 30. Higher values show only high-confidence matches; lower values show more potential matches that may need verification. See How results are scored for details on how certainty is calculated. |
Discovery techniques
SSL Certificates
Searches Certificate Transparency Logs for certificates that include the target domain or its subdomains. The tool examines:
- Current certificates: Active certificates where the target appears in the Common Name or Subject Alternative Names
- Expired certificates: Historical certificates that may reveal previously associated domains
- Organization field: The company name in certificates, used to find other domains with matching organizations
This technique is particularly effective because organizations often include multiple domains in a single certificate or use the same company name across certificates for different domains.
BuiltWith
Searches BuiltWith for technology relationship data. When two websites share the same tracking identifiers (like Google Analytics IDs, Facebook Pixels, or other technology fingerprints), they’re likely owned by the same organization.
The tool considers:
- Whether the relationship is currently active
- How long the relationship has existed
- How many times the relationship appears across different technologies
Reverse Whois
Performs a multi-step Whois analysis:
- Initial lookup: Gets the registrant company and contact email from the target domain’s Whois record
- Reverse lookup on company: Finds all domains registered under the same company name
- Reverse lookup on email: Finds all domains registered with the same contact email
Domain registration data directly links domains to their owners, making this an effective technique.
How results are scored
Each discovered domain receives a certainty score based on multiple factors:
| Factor | Description |
|---|
| SSL certificate matches | How the domain appears in certificates (in target’s cert, in other certs, organization match) |
| BuiltWith relationships | Shared technology identifiers, relationship duration, and current status |
| Whois record matches | Matching registrant companies or contact emails |
| Name similarity | Similar domain names (e.g., amazon.com and amazon.de) |
| Redirect analysis | Whether domains redirect to each other |
Not all discovered domains may belong to your target. Always verify ownership before adding domains to your testing scope.
Follow-up actions
After discovering related domains:
- Verify ownership: Confirm domains belong to the target
- Enumerate subdomains: Use Subdomain Finder on each discovered domain
- Check for takeover risks: Use Subdomain Takeover to find dangling DNS entries
- Look up registration details: Use WHOIS Lookup for domain registration information
- Search for exposed data: Use Google Hacking to find indexed information about discovered domains
- Scan discovered assets: Run appropriate vulnerability scanners on confirmed domains
