Reconnaissance

Attack Surface Discovery

Powered by Subdomain Discovery & Enumeration

Discover all subdomains of your domain using 40+ data sources including certificate transparency logs, DNS records, and web archives.

Try a Free Scan See All Features

What You Get

Subdomain Discovery & Enumeration is fully integrated into Metric Tower's scanning engine. Launch it alongside 74 other modules, or run it on its own.

  • 40+ enumeration sources
  • Certificate transparency logs
  • DNS brute-force with wildcard filtering
  • Permutation generation
  • Subdomain takeover detection

Part of a 75-Module Platform

Metric Tower runs 75+ scanner modules through a six-phase pipeline. Subdomain Discovery & Enumeration runs as one module in this pipeline. Its results feed into downstream scanners automatically.

75+

Scanner Modules

6

Scan Phases

5

Export Formats

9

Ticketing Integrations

How It Works

Metric Tower runs Subdomain Discovery & Enumeration as one of 75+ integrated modules.

1

Add Your Target

Enter a domain, IP address, or URL. MetricTower validates the target and sets up the scan workspace.

2

Select Modules & Launch

Choose Subdomain Discovery & Enumeration along with any combination of other modules. The pipeline handles dependencies and execution order.

3

Review Findings

View real-time results as the scan progresses. Triage findings, export reports in 5 formats, and route alerts to your team.

Compliance Alignment

Helps meet ISO 27001 A.8.1.1 (Asset inventory) and SOC 2 CC6.1 (Logical access).

Metric Tower is a security scanning tool -- it helps you meet compliance requirements but does not provide compliance certifications.

View all compliance mappings

56+

Scanner Modules

6

Scan Phases

Real-Time

Results via WebSocket

SARIF

Export + 4 More Formats

Start Scanning with Subdomain Discovery & Enumeration

Free tier available -- no credit card required.

Start Free View Pricing