I just signed up Cloudfare and they showed me a list of my subdomains by scanning my domain.
How do they do this? What technology is used to scan all subdomains related to a root domain?
I just signed up Cloudfare and they showed me a list of my subdomains by scanning my domain.
How do they do this? What technology is used to scan all subdomains related to a root domain?
They flood your DNS server with requests for "common" entries. It definitely does not get them all, just tried on one of my domains with "weird" subdomains and it only caught about half of them.
One possibility is to just google for the domain name and see what subdomains come up.
E.g.: https://www.google.ch/?q=site:test.com#q=site:test.com