How to do it...

DNSdumpster: It is a free project by HackerTarget that lets us look up subdomains. It relies on https://scans.io/ for its results. It is pretty simple to use.

1. We type the domain name we want and it will show us the results of all the subdomains it could find:

In the following screenshot, we can see the subdomains of the domain packtpub.com:

In the following recipe, we will look at Shodan, which is the most useful source for knowing about what devices are in a network.