Discover subdomains with Sublist3r and Amass

Is your target's attack surface bigger than you think? Most organizations expose dozens, even hundreds, of subdomains that never appear in a simple web search. In this lesson, you'll learn to discover subdomains with Sublist3r and Amass, two essential tools for ethical hacking reconnaissance. By mapping every subdomain, you uncover forgotten admin panels, test environments, and APIs that attackers could exploit — before they do.

The Problem This Lesson Solves

Reconnaissance is the foundation of any security assessment. But if you only look at the main domain, you're missing the majority of the target's digital footprint. Subdomains like dev.example.com, staging.example.com, or old-admin.example.com are often less hardened and more vulnerable. An attacker who finds a forgotten subdomain might gain a foothold that leads to a full compromise.

Manual enumeration is slow, incomplete, and error-prone. You can't guess every possible subdomain, and relying on search engines alone will miss dozens of results. This is where automated tools shine. Sublist3r and Amass scan multiple sources — search engines, certificate transparency logs, DNS datasets, and more — to build a comprehensive list of subdomains quickly and quietly.

By the end of this lesson, you'll be able to use both tools to map an organization's attack surface, compare their outputs, and integrate them into your reconnaissance workflow.

Core Concept / Mental Model

Think of subdomain discovery as digital cartography. The main domain is a city center; subdomains are the surrounding districts, some well-known, others hidden. Your job is to draw a complete map so you don't miss any vulnerable neighborhood.

Sublist3r is your fast scout — it's quick, easy, and grabs the low-hanging fruit from popular sources like Google, Yahoo, Bing, and certificate transparency logs. Amass is the deep explorer — it takes longer but digs into more obscure sources, including DNS brute-forcing and passive databases, uncovering treasures that Sublist3r might miss.

Pro tip: Think of it like fishing with two different nets. Sublist3r uses a wide net to catch the obvious catches; Amass uses a deeper net to find the rare species. Use both for the best results.

How It Works Step by Step

Both tools follow a similar fundamental process: they query multiple data sources, aggregate results, and output a list of unique subdomains. Here's the logical flow:

1. Identify the target domain — for example, example.com.
2. Query passive sources — search engines, certificate transparency logs (like crt.sh), and DNS datasets.
3. Collect potential subdomain names — each source returns a list of uniques.
4. Optionally, perform brute-force enumeration — Amass can test a wordlist of common subdomain names against the target.
5. Aggregate and deduplicate — remove duplicates and sort alphabetically.
6. Output the final list — save it to a file for later analysis.

Sublist3r focuses almost entirely on step 2, using APIs from search engines and certificate logs. Amass goes further, adding brute-force and active data collection through its own modules.

Hands-On Walkthrough

Let's get your hands dirty. First, install both tools — they're available on most Linux distributions and macOS.

Installing Sublist3r and Amass

# Clone and install Sublist3r
git clone https://github.com/aboul3la/Sublist3r.git
cd Sublist3r
pip install -r requirements.txt

# Install Amass (using go install or package manager)
go install -v github.com/owasp-amass/amass/v4/...@master
# Or on Kali Linux: sudo apt install amass

Note: Amass is also available as a Docker image for containerized environments.

Basic Sublist3r Usage

Run Sublist3r against a target domain (use a domain you own or have permission to test):

python sublist3r.py -d example.com

Expected output includes the tool's banner and then a list of subdomains:

[+] Enumerating subdomains now for example.com
[+] Searching now in Baidu..
[+] Searching now in Yahoo..
[+] Searching now in Google..
[+] Searching now in Bing..
[+] Searching now in Ask..
[+] Searching now in Netcraft..
[+] Searching now in DNSdumpster..
[+] Searching now in Virustotal..
[+] Searching now in ThreatCrowd..
[+] Searching now in SSL Certificates..

[!] Example.com: 142 subdomains found.

Basic Amass Usage

Amass offers passive, active, and brute-force modes. Start with passive to be stealthy:

amass enum -passive -d example.com

For a more thorough scan that includes brute-forcing, use:

amass enum -active -d example.com -brute -w /path/to/wordlist.txt

Example output:

OWASP Amass v3.23.0
...
[+] 142 subdomains discovered
...

Saving Results to a File

Both tools can output to a file for later analysis — critical for large scope assessments:

# Sublist3r
python sublist3r.py -d example.com -o sublist3r_results.txt

# Amass
amass enum -passive -d example.com -o amass_results.txt

Combining Outputs for Maximum Coverage

Run both tools and merge the results, deduplicating as you go:

sublist3r.py -d example.com -o sublist3r.txt
amass enum -passive -d example.com -o amass.txt

cat sublist3r.txt amass.txt | sort -u > all_subdomains.txt
wc -l all_subdomains.txt

This gives you the union of both tools' findings — a more complete map of the attack surface.

Compare Options / When to Choose What

The table below summarizes the key differences:

• Choose Sublist3r for a first pass or when you need quick results with minimal setup.
• Choose Amass for a thorough engagement where time isn't a constraint and you want maximum coverage.
• Use both in a real engagement — the overlap confirms findings, and the differences fill gaps.

Troubleshooting & Edge Cases

Sublist3r Shows No Results

• Cause: Your IP may be rate-limited by search engines, or the domain has few indexed subdomains.
• Fix: Wait and retry, or run with -v verbose mode to see API responses.

Amass Too Slow

• Cause: Running -active without a wordlist can be slow and noisy.
• Fix: Use -passive for quick results, or limit brute-force with a smaller wordlist.

Permission Denied on Output File

• Cause: Writing to a restricted directory.
• Fix: Use a writable path, e.g., -o /tmp/results.txt.

Missing Dependency Errors

• Cause: Python packages not installed for Sublist3r, or Go not configured for Amass.
• Fix: Run pip install -r requirements.txt or check $GOPATH.

Duplicate Subdomains Across Tools

• Cause: Different tools query overlapping sources.
• Fix: Always sort and deduplicate when combining sort -u.

What You Learned & What's Next

You now know how to discover subdomains with Sublist3r and Amass, understanding the core concepts, step-by-step workflows, and practical comparisons. You demonstrated the application of these tools in a hands-on exercise, and you're ready for the next step in your ethical hacking journey: probing discovered subdomains for live hosts and open ports — the next lesson in this track.