Automated Subdomain Enumeration

Overview

Subdomain discovery is a critical first step in reconnaissance. Forgotten subdomains often contain vulnerabilities, outdated software, or misconfigurations that attackers can exploit. A systematic approach combines multiple data sources and techniques to build a comprehensive subdomain list.

Core principle: Combine passive reconnaissance (non-intrusive) with active enumeration (DNS queries, brute-forcing) to maximize coverage while respecting scope and legal boundaries.

When to Use

Use this skill when:

• Starting reconnaissance on a new target domain
• Building an inventory of an organization's attack surface
• Hunting for forgotten or shadow IT assets
• Looking for development, staging, or test environments
• Preparing for comprehensive vulnerability assessment

Don't use when:

• Outside authorized scope (get written permission first)
• Rate limiting or WAF might trigger alerts prematurely
• Target has strict testing windows you must respect

The Multi-Phase Approach

Phase 1: Passive Reconnaissance

Goal: Gather subdomains without directly touching target infrastructure.

Techniques:

1. Certificate Transparency Logs

   # Use crt.sh or similar CT log search
   curl -s "https://crt.sh/?q=%25.target.com&output=json" | \
     jq -r '.[].name_value' | \
     sed 's/\*\.//g' | \
     sort -u > ct_subdomains.txt
   

2. Search Engine Dorking

   # Google dorks for subdomains
   # site:target.com -www
   # Use tools like subfinder, amass with passive sources
   subfinder -d target.com -silent -all -o passive_subdomains.txt
   

3. DNS Aggregators

   • SecurityTrails
   • VirusTotal
   • DNSdumpster
   • Shodan

4. GitHub/GitLab Code Search

   # Search for domain mentions in code
   # "target.com" site:github.com
   # Look for: config files, API endpoints, documentation
   

5. Web Archives

   # Wayback Machine API
   curl -s "http://web.archive.org/cdx/search/cdx?url=*.target.com/*&output=json&fl=original&collapse=urlkey" | \
     jq -r '.[] | .[0]' | \
     grep -oP '(?<=://)[^/]*' | \
     sort -u >> archive_subdomains.txt
   

Phase 2: Active Enumeration

Goal: Actively query DNS infrastructure to discover additional subdomains.

Techniques:

1. Brute Force with Wordlists

   # Use tools like puredns, massdns, or dnsx
   puredns bruteforce wordlist.txt target.com \
     --resolvers resolvers.txt \
     --write active_subdomains.txt
   

2. DNS Zone Transfers (if misconfigured)

   # Test for zone transfer vulnerability
   dig axfr @ns1.target.com target.com
   

3. Reverse DNS Lookups

   # Get IP ranges, perform reverse lookups
   # Useful for finding additional subdomains on same infrastructure
   

4. Permutation Scanning

   # Generate permutations of found subdomains
   # Example: dev.api.target.com, staging.api.target.com
   altdns -i subdomains.txt -o permuted.txt -w words.txt
   dnsx -l permuted.txt -o verified_permuted.txt
   

Phase 3: Validation and Enrichment

Goal: Verify discovered subdomains are live and gather additional context.

1. Live Host Detection

   # Use httpx to probe for web services
   cat all_subdomains.txt | httpx -silent -o live_hosts.txt
   
   # Get status codes, titles, tech stack
   httpx -l all_subdomains.txt -title -tech-detect -status-code -o enriched.txt
   

2. Port Scanning

   # Identify services on discovered hosts
   naabu -list live_hosts.txt -p 80,443,8080,8443 -o ports.txt
   

3. Screenshot Capture

   # Visual reconnaissance of web interfaces
   gowitness file -f live_hosts.txt -P screenshots/
   

4. Technology Fingerprinting

   # Identify web technologies, frameworks, CMS
   wappalyzer -l live_hosts.txt -o tech_stack.json
   

Phase 4: Organization and Analysis

Goal: Structure discovered data for efficient analysis and next steps.

1. Categorize Subdomains

   • Production vs. development/staging/test
   • Internal-facing vs. external-facing
   • By technology stack or function
   • By sensitivity/criticality

2. Prioritize Targets

   • High-value targets: admin, api, dev, staging, test, vpn, mail
   • Outdated software versions
   • Unusual ports or services
   • Error messages or debug pages

3. Document Findings

   # Target: target.com
   
   ## Statistics
   - Total subdomains discovered: X
   - Live hosts: Y
   - Unique IP addresses: Z
   - Technologies identified: [list]
   
   ## High-Priority Targets
   1. dev.api.target.com - Swagger UI exposed, no auth
   2. old-admin.target.com - PHP 5.6, potential RCE
   3. test-payment.target.com - Test environment with prod data?
   
   ## Next Steps
   - Deep enumeration of api.target.com endpoints
   - Vulnerability scan of outdated PHP instance
   - Manual inspection of test environment
   

Tool Recommendations

All-in-one suites:

• Amass (comprehensive, integrates many sources)
• Subfinder (fast passive enumeration)
• Assetfinder (simple, effective)

Specialized tools:

• Puredns (DNS validation and brute-forcing)
• DNSx (DNS toolkit with various features)
• Httpx (HTTP probing and enrichment)
• Naabu (fast port scanner)
• Gowitness (screenshot capture)

Setup example:

# Install Go tools
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

# Install other dependencies
pip install altdns

Automation Script Template

#!/bin/bash
# automated_subdomain_enum.sh

DOMAIN=$1
OUTPUT_DIR="${DOMAIN}_recon_$(date +%Y%m%d_%H%M%S)"
mkdir -p "$OUTPUT_DIR"

echo "[*] Starting subdomain enumeration for $DOMAIN"

# Phase 1: Passive
echo "[*] Phase 1: Passive reconnaissance"
subfinder -d "$DOMAIN" -all -silent -o "$OUTPUT_DIR/subfinder.txt"
assetfinder --subs-only "$DOMAIN" > "$OUTPUT_DIR/assetfinder.txt"
curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > "$OUTPUT_DIR/crtsh.txt"

# Combine and deduplicate
cat "$OUTPUT_DIR"/{subfinder,assetfinder,crtsh}.txt | sort -u > "$OUTPUT_DIR/passive_all.txt"
echo "[+] Found $(wc -l < "$OUTPUT_DIR/passive_all.txt") unique subdomains (passive)"

# Phase 2: Active (optional, comment out if too noisy)
# echo "[*] Phase 2: Active enumeration"
# puredns bruteforce /path/to/wordlist.txt "$DOMAIN" -r /path/to/resolvers.txt -w "$OUTPUT_DIR/bruteforce.txt"

# Phase 3: Validation
echo "[*] Phase 3: Validating and probing subdomains"
cat "$OUTPUT_DIR/passive_all.txt" | dnsx -silent -o "$OUTPUT_DIR/validated.txt"
httpx -l "$OUTPUT_DIR/validated.txt" -title -status-code -tech-detect -silent -o "$OUTPUT_DIR/live_hosts.txt"

echo "[+] Found $(wc -l < "$OUTPUT_DIR/live_hosts.txt") live hosts"
echo "[*] Results saved to $OUTPUT_DIR/"

Legal and Ethical Considerations

CRITICAL: Always follow these rules:

1. Get Written Authorization

   • Never test targets without explicit permission
   • Scope must be clearly defined in writing
   • Understand what techniques are permitted

2. Respect Rate Limits

   • Don't overwhelm target DNS servers
   • Use reasonable delays between requests
   • Consider impact on production systems

3. Handle Data Responsibly

   • Discovered subdomains may reveal sensitive information
   • Don't publicly disclose findings without permission
   • Follow responsible disclosure practices

4. Document Everything

   • Keep records of authorization
   • Log all activities with timestamps
   • Document findings systematically

Common Pitfalls

| Mistake | Impact | Solution | |---------|--------|----------| | Only using one data source | Miss many subdomains | Combine multiple techniques | | Skipping validation | False positives waste time | Always verify with DNS queries | | Too aggressive active scanning | Detection, blocking, legal issues | Start passive, escalate carefully | | Not categorizing results | Inefficient analysis | Organize findings by priority | | Ignoring out-of-scope domains | Legal/ethical violations | Strictly adhere to authorized scope |

Integration with Other Skills

This skill works with:

• skills/reconnaissance/web-app-recon - Next step after finding live web apps
• skills/reconnaissance/service-fingerprinting - Identify services on discovered hosts
• skills/automation/* - Automate the full recon pipeline
• skills/documentation/* - Organize findings in knowledge base

Success Metrics

A successful subdomain enumeration should:

• Discover both obvious and hidden subdomains
• Identify live hosts and their technologies
• Categorize findings by risk/priority
• Provide actionable next steps
• Complete within scope and authorization
• Document findings for future reference

References and Further Reading

• OWASP Testing Guide: Information Gathering
• "Bug Bounty Bootcamp" by Vickie Li (Chapter on Reconnaissance)
• ProjectDiscovery blog on subdomain enumeration
• DNS RFC standards for understanding DNS behavior