{
  "slug": "subdomain-enumeration",
  "title": "Subdomain Enumeration",
  "phase": "Reconnaissance",
  "description": "Systematically discover all subdomains of a target to map the full attack surface before active testing begins.",
  "difficulty": "medium",
  "tags": [
    "reconnaissance",
    "dns",
    "passive",
    "active",
    "attack-surface"
  ],
  "tools": [
    "subfinder",
    "amass",
    "assetfinder",
    "dnsx",
    "httpx",
    "puredns",
    "gotator"
  ],
  "steps": [
    {
      "id": "subenum-01",
      "title": "Passive DNS enumeration",
      "description": "Query certificate transparency logs, passive DNS databases, and public aggregators without touching the target directly.",
      "commands": [
        "subfinder -d target.com -all -o passive-subs.txt",
        "amass enum -passive -d target.com -o amass-passive.txt",
        "assetfinder --subs-only target.com >> passive-subs.txt",
        "sort -u passive-subs.txt amass-passive.txt -o subs-dedup.txt"
      ],
      "notes": "Always start passive to avoid detection and stay within programme rules. Merge and deduplicate all outputs before proceeding."
    },
    {
      "id": "subenum-02",
      "title": "Active DNS brute-force",
      "description": "Brute-force subdomain names using curated wordlists against the target's authoritative DNS servers.",
      "commands": [
        "puredns brute all.txt target.com -r resolvers.txt -w brute-subs.txt",
        "amass enum -active -brute -d target.com -w dns-Jhaddix.txt -o amass-brute.txt"
      ],
      "notes": "Use a validated, up-to-date resolver list to minimise false positives and avoid rate-limit bans."
    },
    {
      "id": "subenum-03",
      "title": "DNS resolution and HTTP probing",
      "description": "Resolve discovered hostnames to IP addresses, then probe each for live HTTP/HTTPS services.",
      "commands": [
        "cat subs-dedup.txt brute-subs.txt | sort -u | dnsx -silent -o resolved.txt",
        "cat resolved.txt | httpx -silent -title -status-code -tech-detect -o live-hosts.txt"
      ]
    },
    {
      "id": "subenum-04",
      "title": "Permutation and alteration scanning",
      "description": "Generate subdomain variations from discovered patterns and test them against DNS.",
      "commands": [
        "gotator -sub resolved.txt -perm permutations.txt -depth 1 -silent | dnsx -silent -o perm-hits.txt",
        "altdns -i resolved.txt -o altdns-out.txt -w words.txt -r -s altdns-resolved.txt"
      ],
      "notes": "Permutation scanning often reveals staging, dev, and internal subdomains that simple brute-force misses."
    },
    {
      "id": "subenum-05",
      "title": "Subdomain takeover check",
      "description": "Identify dangling DNS records pointing to deprovisioned cloud services.",
      "commands": [
        "nuclei -l resolved.txt -t takeovers/ -o takeover-findings.txt",
        "subzy run --targets resolved.txt --output takeover-subzy.txt"
      ]
    }
  ],
  "references": [
    "https://github.com/projectdiscovery/subfinder",
    "https://github.com/owasp-amass/amass",
    "https://github.com/d3mondev/puredns",
    "https://github.com/projectdiscovery/dnsx",
    "https://github.com/tomnomnom/assetfinder"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-04-04"
}