The product
Sublist3r is a python tool for enumerating subdomains using OSINT and various search engines.
The closest Sublist3r alternatives are ctlogs.dev, MGM Security Partners recon me and Detectify Platform. Picking a Sublist3r alternative comes down to fit: External Attack Surface Management coverage, your environment, your integrations and your budget. So each option below shows what it covers, how it deploys, its pricing model and the company behind it.
Closest 48 alternatives shownClosest matches: ctlogs.dev, MGM Security Partners recon me, Detectify PlatformPage updated Nov 2026
The product
Sublist3r is a python tool for enumerating subdomains using OSINT and various search engines.
Sublist3r is a free External Attack Surface Management solution. The closest matches by shared tags and NIST CSF 2.0 coverage are ctlogs.dev, MGM Security Partners recon me, Detectify Platform, Detectify Surface Monitoring, and Halo Security Attack Surface Discovery. All 48 alternatives on this page are ranked the same way.
These 8 solutions overlap most with Sublist3r. Each row says what the product does and, when the overlap is big enough, which capabilities it shares.
Fast Certificate Transparency search and JSON API for subdomain reconnaissance.
Key features: Real-time Certificate Transparency Search, Automated Subdomain Enumeration, High-Performance REST JSON API, Wildcard & Fingerprint Matching, SSL/TLS Certificate History Tracking
View ctlogs.devctlogs.dev alternativesSublist3r vs ctlogs.dev
recon me is an OSINT tool developed by mgm Security Partners and used as part of the company's OSINT analysis service. The tool collects and correlates publicly available information about an organization's external attack surface, including domains, subdomains, servers, technologies used, metadata, and publicly accessible files. It supports two scan modes: - Passive scan: queries public directory services such as Whois, DNS, and MX records to identify servers, subdomains, email addresses, technologies, and operators (e.g. Amazon, Akamai) without any interaction with target systems. - Active scan: directly examines the target domain without performing attacks, to identify additional services, technologies, or unintentionally exposed files. Results from recon me are combined with manual expert analysis and used to produce a report detailing identified assets, potential vulnerabilities, misconfigurations, and prioritized recommendations. The output is intended to give organizations a view of their public attack surface from an attacker's perspective and can serve as a basis for further security testing such as penetration tests.</description> <parameter name="summary">Proprietary OSINT tool for mapping an organization's public attack surface
Key features: 8 listed. See them on the MGM Security Partners recon me page.
View MGM Security Partners recon meMGM Security Partners recon me alternativesSublist3r vs MGM Security Partners recon me
Platform for external attack surface management and application security testing
Key features: 10 listed. See them on the Detectify Platform page.
View Detectify PlatformDetectify Platform alternativesSublist3r vs Detectify Platform
Monitors internet-facing subdomains for vulnerabilities and misconfigurations
Key features: 10 listed. See them on the Detectify Surface Monitoring page.
View Detectify Surface MonitoringDetectify Surface Monitoring alternativesSublist3r vs Detectify Surface Monitoring
Discovers and inventories internet-facing assets including subdomains, IPs, and apps.
Key features: 10 listed. See them on the Halo Security Attack Surface Discovery page.
View Halo Security Attack Surface DiscoveryHalo Security Attack Surface Discovery alternativesSublist3r vs Halo Security Attack Surface Discovery
Attack surface management platform for discovering and securing exposed assets
Key features: 10 listed. See them on the Intruder Discover Attack Surface page.
View Intruder Discover Attack SurfaceIntruder Discover Attack Surface alternativesSublist3r vs Intruder Discover Attack Surface
ASM platform that scans external attack surfaces hourly for vulnerabilities
Key features: 10 listed. See them on the Searchlight Exposure page.
View Searchlight ExposureSearchlight Exposure alternativesSublist3r vs Searchlight Exposure
Automated digital asset discovery and monitoring for external attack surface
Key features: 10 listed. See them on the Ceeyu Digital Footprint Monitoring page.
View Ceeyu Digital Footprint MonitoringCeeyu Digital Footprint Monitoring alternativesSublist3r vs Ceeyu Digital Footprint Monitoring
Fast Certificate Transparency search and JSON API for subdomain reconnaissance.
Platform for external attack surface management and application security testing
Monitors internet-facing subdomains for vulnerabilities and misconfigurations
Discovers and inventories internet-facing assets including subdomains, IPs, and apps.
Attack surface management platform for discovering and securing exposed assets
ASM platform that scans external attack surfaces hourly for vulnerabilities
Automated digital asset discovery and monitoring for external attack surface
OSINT tool for mapping & monitoring risk ecosystems on Clear & Deep Web.
AI-powered EASM platform for digital asset discovery and monitoring.
ASM platform monitoring external attack surface, dark web leaks & 3rd-party risks.
Sn1per Professional 2026: automated penetration testing & attack surface management
AI-enhanced EASM platform for external attack surface discovery and monitoring.
Continuous external attack surface monitoring that shows what changed between scans.
Agentless external attack surface monitoring with continuous change detection.
Continuous, agentless discovery and threat-intel enrichment of external internet-facing
Human-validated external attack surface risk prioritization combining scanning
Internet-wide scanning platform for discovering exposed devices, services
Scans domains to discover attack surface, vulnerabilities, and generate hardening
Cloud platform for continuous visibility & mgmt of external attack surfaces
AI-powered attack surface management platform for cybersecurity monitoring
AI-powered platform for continuous attack surface discovery and pentesting
Discovers and monitors external-facing assets and vulnerabilities
External attack surface mgmt platform for discovering & monitoring assets
External attack surface management platform with continuous asset discovery
External attack surface management platform for discovering digital assets
Internet intelligence platform for asset discovery and attack surface mapping
SaaS platform for attack surface management and vulnerability detection
EASM platform for continuous monitoring of internet-exposed assets & vulnerabilities
Supply chain intelligence platform mapping digital ecosystems & proximity risks
Attack surface mgmt platform with vuln scanning and cloud security features
Attack surface management platform for monitoring vulnerabilities and breaches
Discovers and monitors external internet assets for exposures and vulnerabilities
Discovers and manages internet-facing assets with vulnerability prioritization
ImmuniWeb Discovery is an attack surface management platform that continuously monitors an organization's external digital assets for security vulnerabilities, misconfigurations, and threats across domains, applications, cloud resources, and the dark web.
External attack surface mgmt with automated pentesting and validation
SOCRadar DNS Monitoring provides real-time monitoring of DNS infrastructure with automated discovery, record change alerts, and detection of DNS-based security threats.
SOCRadar Attack Surface Management is an EASM platform that continuously discovers, monitors, and assesses internet-facing digital assets for vulnerabilities and security risks.
Automated ASM tool for multi-cloud environments with continuous asset discovery
External attack surface mgmt with asset discovery and on-demand pentesting
Active attack surface mgmt solution for discovering & remediating unknown risks
Internet intelligence platform for asset discovery and threat analysis
AI-driven internet scanning platform for asset discovery and threat hunting
Passive asset discovery platform using Netflow data for attack surface mapping
DNS security posture management across multicloud and on-prem environments
Common questions when weighing alternatives to Sublist3r.
The closest matches to Sublist3r by shared tags and NIST CSF 2.0 coverage are ctlogs.dev, MGM Security Partners recon me, Detectify Platform, Detectify Surface Monitoring, and Halo Security Attack Surface Discovery. All of them are External Attack Surface Management products.
This page shows 48 alternatives to Sublist3r, all in the External Attack Surface Management category. Each one is matched on shared tags and NIST CSF 2.0 areas, and the closest matches rank first.
Sublist3r is a free External Attack Surface Management product. You can use it at no cost. Only commercial alternatives are listed here. Free and open source products are under /free.
Sublist3r is a External Attack Surface Management product in the Exposure & Vulnerability Management category. You can compare it with the 48 other External Attack Surface Management products on this page.
Need the answer fast? Best Attack Surface Management Solutions for Business picks Palo Alto Networks Cortex Xpanse, Microsoft Defender EASM, Mandiant Attack Surface Management and 4 more.See the shortlist
