Subdomain discovery

Hello team,

Is it possible to do subdomain discovery with OpenVAS?

I was not able to find any VTs for this purpose. However, that doesn’t mean there isn’t one, but I don’t think there is…

You could look at the subfinder package. I think that finding subdomains relies on enumerating possible subdomains or collecting them from available internet links. To my knowledge, there is no way to query the DNS system to provide a list of all A/AAAA records with the same TLD.


and welcome to this community forums.

The openvas-scanner is a classical automated network based vulnerability scanner and such functionality like enumerating additional subdomains is not in the scope of the scanner.

Subdomain enumeration is usually more a topic for penetration testing and bug bounty hunting for which dedicated tools like mentioned previously exists.