As more and more companies create Bug Bounty programs with open-ended scopes, vertical domain discovery has become essential to bug bounty hunters. Vertical domain discovery describes an attempt to find all domain names owned by a given company. These other domain names can be used to host internal services, microsites, or services outside the company's main domain name. Since they exist outside the central domain, these websites are often markedly less secure, making them easy targets for penetration testers.

Elevate is a tool that I have created in order to automate the arduous process of collecting domain names owned by a given company. This tool utilizes API's from various sources in order to compile large domain lists. Users are able to search for domains by organization name, root domain name, or email address.

​

Check out the tool here - https://github.com/Healdb/Elevate