Prompt tools for searching subdomains

Question

Computer networks

Interested in tools for searching for subdomains under *nix.
I tried utilities such as host and dig, but they often do not give a complete list of subdomains.

The following script was written that checks existing subdomains using a dictionary:

#!/bin/sh

domain=$1

trap break SIGINT
for d in access admin adsl alpha b2b b2c backup beta bigip blog blogg blogs cisco cms confixx content csv data database datenbank db de dev devel dns dns1 dns2 domino down download downloads dsl en entwicklung exchange extern extra extranet f5 files firewall forum fr ftp fw fw1 gate gatekeeper gateway gw gw1 home homepage homepages ids imap intern intra intranet irc it ja log logging logs mail-in mail-out mail mail01 mail02 mail03 mail1 mail2 mail3 mail4 mailin mailout mx mx01 mx02 mx03 mx1 mx2 mx3 mysql nameserver neu new news notes ns ns01 ns02 ns03 ns1 ns2 ns3 old owa owa2k pop pop3 ppp proxy sec secure security sendmail sicher smtp sql ssl stage stageing staging test test1 test2 up upload us vpn web web1 web2 webmail www www1 www2 www3 www4;
do
    host -W1 $d.$domain 8.8.8.8 > /dev/null && echo $d.$domain - OK
done 

But this is just a dictionary lookup. I would like to have a better search tool.
I would be grateful for advice on improving the script or recommendations of existing solutions for my task.

Answer 1

stackoverflow.com/questions/131989/how-do-i-get-a-list-of-all-subdomains-of-a-domain