pdlist: passive subdomain finder
pdlist is a passive subdomain finder written in python. This tool can be used effectively to collect information about a domain without ever sending a single packet to any of its hosts. Given a domain like “example.com” it will find all the hosts which have a hostname <something>.example.com or URLs strictly related to example.com.
In order to collect information about subdomains the software queries different publicly available websites, which at the moment are:
pdlist is very user-friendly and lightweight since the only dependencies are the following python modules:
git clone https://github.com/gnebbia/pdlist
pip install -r requirements.txt
python setup.py install
To have a list of subdomains passively of for example example.com we can do:
we can also specify multiple domains, e.g.,;
pdlist example1.com example2.com
We can save the output in a text file by doing:
pdlist example.com -o example-list.txt
Notice that by default pdlist will also output hostnames which may not really be proper subdomains of the specified domains, and this happens because those subdomains are still related to the specified domains.
If we want to only output proper subdomains we can enable the strict mode by doing:
pdlist example.com --strict
Copyright © 2019, GNC