问题
I want to find out all the subdomains of a given domain. I found a hint which tells me to dig the authoritative Nameserver with the following option:
dig @ns1.foo.bar some_domain.com axfr
But this never works. Has anyone a better idea/approach
回答1:
The hint (using axfr) only works if the NS you're querying (ns1.foo.bar in your example) is configured to allow AXFR requests from the IP you're using; this is unlikely, unless your IP is configured as a secondary for the domain in question.
Basically, there's no easy way to do it if you're not allowed to use axfr. This is intentional, so the only way around it would be via brute force (i.e. dig a.some_domain.com, dig b.some_domain.com, ...), which I can't recommend, as it could be viewed as a denial of service attack.
回答2:
If you can't get this information from DNS (e.g. you aren't authorized) then one alternative is to use Wolfram Alpha.
- Enter the domain into the search box and run the search. (E.g. stackexchange.com)
- In the 3rd section from the top (named "Web statistics for all of stackexchange.com") click Subdomains
- In the Subdomains section click More
You will be able to see a list of sub-domains there. Although I suspect it does not show ALL sub-domains.
回答3:
You can use:
$ host -l domain.comUnder the hood, this uses the AXFR query mentioned above. You might not be allowed to do this though. In that case, you'll get a transfer failed message.
回答4:
dig somedomain.com soadig @ns.SOA.com somedomain.com axfr
回答5:
robotex tools which are free will let you do this but they make you enter the ip of the domain first:
- find out the ip (there's a good ff plugin which does this but I can't post the link cos this is my first post here!)
- do an ip search on robotex: http://www.robtex.com/ip/
- in the results page that follows click on the domain you're interested in>
- you are taken to a page that lists all subdomains + a load of other information such as mail server info
回答6:
In Windows nslookup the command is
ls -d somedomain.com > outfile.txt
which stores the subdomain list in outfile.txt
few domains these days allow this
回答7:
You can only do this if you are connecting to a DNS server for the domain -and- AXFR is enabled for your IP address. This is the mechanism that secondary systems use to load a zone from the primary. In the old days, this was not restricted, but due to security concerns, most primary name servers have a whitelist of: secondary name servers + a couple special systems.
If the nameserver you are using allows this then you can use dig or nslookup.
For example:
#nslookup
>ls domain.com
NOTE: because nslookup is being deprecated for dig and other newere tools, some versions of nslookup do not support "ls", most notably Mac OS X's bundled version.
回答8:
You can use this site to find subdomains Find subdomains
This tool will try a zone transfer and also query search engines for list of subdomains.
回答9:
If the DNS server is configured properly, you won't be able to get the entire domain. If for some reason is allows zone transfers from any host, you'll have to send it the correct packet to make that request. I suspect that's what the dig statement you included does.
来源：https://stackoverflow.com/questions/131989/how-do-i-get-a-list-of-all-subdomains-of-a-domain