Subdomain Enumeration
Subdomain enumeration is finding all the subdomains of a target, because the vulnerable asset is almost always the one nobody remembered owning. The workflow is passive discovery first, through certificate transparency and public data, then active brute forcing, then permutation of what you found, and finally probing which ones are actually live.
Why it matters more than anything in recon
The main site is hardened and tested. The forgotten staging server, the old marketing microsite, the abandoned API subdomain, those are where findings live. Broaden the attack surface and you find what others missed. This is the first move in bug bounty and every external engagement.
Passive enumeration first
Passive means the target never knows you looked. Sources:
| Source | What it gives |
|---|---|
| Certificate transparency | Subdomains from issued TLS certs |
| Public datasets | Historical DNS records |
| Search engines | Indexed subdomains via dorking |
| Third party APIs | Aggregated passive data |
Certificate transparency is the highest value source, because every TLS certificate ever issued for the domain is logged publicly.
subfinder -d example.com
amass enum -passive -d example.comActive brute forcing
Guess subdomains against a wordlist and resolve them. Louder, but finds names not in any public record.
ffuf -w wordlist.txt -u https://FUZZ.example.com
gobuster dns -d example.com -w wordlist.txtPermutation
Take the subdomains you found and generate variations: dev, staging, test, old, api prefixes and suffixes. The pattern dev-api often exists next to api. Tools automate this from your existing results.
Probing for live hosts
A subdomain in a record does not mean it responds. Probe them to find the live ones and capture titles and status codes, so you know what is worth testing.
cat subs.txt | httpx -title -status-codeTurning subdomains into targets
Once you have live subdomains: fingerprint each, look for forgotten or outdated apps, check for subdomain takeover on dangling DNS, and feed the interesting ones into deeper testing. This connects to Google dorking and full recon methodology.
The workflow
- Passive: certificate transparency and public data
- Active: brute force against a wordlist
- Permute: generate variations of found names
- Probe: find which are live
- Fingerprint and prioritise
Practise this
Enumerate authorised targets only, or your own domains. Free recon challenges on Hacklido.
Enroll in VAPT
Live instructor led training with hands on labs and a verifiable certificate. Or start free on Hacklido.
Enroll in VAPT