Listen to this Post
Introduction:
Subdomain enumeration is a critical reconnaissance phase in cybersecurity, bug bounty hunting, and penetration testing, allowing security professionals to dramatically expand their attack surface. By discovering hidden, forgotten, or development subdomains, attackers and defenders can identify vulnerable entry points that are often overlooked. This article details a sophisticated methodology that leverages 17 different sources and three core tools to achieve subdomain discovery results far beyond conventional tools like Subfinder.
Learning Objectives:
- Master a multi-source, multi-tool passive subdomain enumeration workflow.
- Learn to execute and chain advanced commands for comprehensive discovery.
- Understand how to validate and process results for active security testing.
You Should Know:
1. Passive Enumeration with Amass
Amass is a powerful tool for performing passive subdomain enumeration by querying a vast array of data sources without sending direct traffic to the target.
`amass enum -passive -d target.com -o amass_passive.txt`
This command instructs Amass to perform a passive enumeration on the domain target.com. The `-passive` flag ensures no direct resolution attempts are made against the target, relying solely on OSINT data sources. The results are saved to amass_passive.txt. First, install Amass via your package manager (sudo apt install amass). Then, run the command in your terminal, replacing `target.com` with your target domain. The output file will contain a list of subdomains gathered from certificates, archives, and other public data.
2. Brute-Forcing with Assetfinder and Pure DNS Resolution
Combining Assetfinder’s data aggregation with a high-quality wordlist and pure DNS resolution can uncover subdomains that passive methods miss.
`assetfinder –subs-only target.com | tee assetfinder.txt`
`altdns -i all_subdomains.txt -o alt_output -w words.txt -r -s resolved_subs.txt`
The first command uses Assetfinder to find subdomains related to target.com, outputting only the subdomain names and saving them to a file. The second command uses AltDNS to generate permutations of discovered subdomains using a wordlist (words.txt), then resolves them (-r) to filter out non-existent domains, saving the valid ones to resolved_subs.txt. Pipe the initial list of subdomains into AltDNS after installing both tools (go install github.com/tomnomnom/assetfinder@latest and pip install pyaltdns). This technique bruteforces possible subdomain names, catching common prefixes like dev, staging, or test.
3. Rapid Subdomain Discovery with Subfinder
Subfinder is a fast passive subdomain discovery tool that uses a curated list of sources to find valid subdomains.
`subfinder -d target.com -o subfinder.txt -all`
This command executes Subfinder against target.com, with the `-all` flag enabling all available sources (including paid ones if API keys are configured) for maximum coverage. The results are written to subfinder.txt. After installing Subfinder (go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest), run this command as the first step in your enumeration. For enhanced results, configure API keys in the `$HOME/.config/subfinder/provider-config.yaml` file for services like SecurityTrails, Censys, and PassiveTotal.
4. Certificate Transparency Log Aggregation
Certificate Transparency (CT) logs are a goldmine for discovering subdomains, as every SSL/TLS certificate issued is publicly recorded.
`curl -s “https://crt.sh/?q=%.target.com&output=json” | jq -r ‘.[].name_value’ | sed ‘s/\\.//g’ | sort -u > crt_sh.txt`
This one-liner queries the `crt.sh` database for certificates related to target.com. The `jq` command parses the JSON output to extract the `name_value` fields (the domains), and `sed` removes any wildcard characters (“). The final sorted, unique list is saved to crt_sh.txt. This method requires `curl` and `jq` to be installed. It is entirely passive and can reveal historical and current subdomains associated with the target’s certificates.
5. Comprehensive Data Synthesis and Deduplication
After gathering data from multiple sources, the results must be combined, cleaned, and prepared for the next stage.
`cat amass_passive.txt subfinder.txt assetfinder.txt crt_sh.txt | sort -u > all_subdomains_combined.txt`
`httpx -l all_subdomains_combined.txt -silent -threads 100 -o live_subdomains.txt`
The first command concatenates all the individual result files, sorts them, and removes duplicates into a single master file. The second command uses HTTPx to probe these subdomains, checking which ones are live (return an HTTP response), and saves the active ones. This filtering is crucial; it separates the signal from the noise, allowing you to focus your security testing on valid, accessible targets. Use a high thread count with `httpx` for speed, but be mindful of the target’s rate limiting.
6. Permutation-Based Discovery with Gotator
For deeper enumeration, generating permutations of known subdomains can uncover hidden assets.
`gotator -sub all_subdomains_combined.txt -perm permutations_list.txt -depth 1 -numbers 10 -mindup -adv -md | dnsx -silent -r 8.8.8.8 -a -resp-only > permuted_resolved.txt`
This powerful chain uses Gotator to create permutations (e.g., `api-dev` from api) based on a wordlist (permutations_list.txt), including number suffixes. It then pipes the massive list to DNSx, which performs bulk DNS A record lookups to resolve only the valid permutations. Install Gotator and DNSx from ProjectDiscovery (go install commands). This is an active technique that can generate significant DNS traffic but is highly effective for discovering obfuscated or new subdomains.
7. Final Validation and Service Discovery
The final step involves validating the live targets and identifying the technologies and services running on them.
`cat live_subdomains.txt | naabu -host -ports full -o naabu_scan.txt`
`cat live_subdomains.txt | nuclei -t /path/to/nuclei-templates/ -o nuclei_scan_results.txt`
The first command uses Naabu to perform a port scan on all live subdomains across all ports (-ports full), identifying open services beyond just HTTP/HTTPS. The second command runs Nuclei, a fast vulnerability scanner, against the live subdomains using a wide array of detection templates to instantly check for common misconfigurations and known vulnerabilities. This transitions the workflow from reconnaissance to initial vulnerability assessment, providing immediate value for bug bounty hunters and penetration testers.
What Undercode Say:
- The shift from single-tool to orchestrated, multi-source enumeration is no longer optional for comprehensive attack surface mapping. Relying on one tool like Subfinder leaves a significant portion of the attack surface undiscovered.
- The true power lies in the synthesis of passive data aggregation and intelligent, permission-based active discovery, followed by rigorous validation with tools like HTTPx and DNSx.
The methodology outlined represents the modern standard for reconnaissance. The claim of discovering “5x more subdomains” is plausible when comparing a simple Subfinder run to this layered approach, which incorporates certificate logs, multiple passive tools, and permutation bruteforcing. This process systematically dismantles the obscurity that organizations rely on for “hidden” infrastructure. For defenders, this underscores the critical need to manage certificate lifecycles and maintain a complete, continuously updated asset inventory, as any domain ever associated with the organization is a matter of public record. For offensive security professionals, this workflow is foundational, turning a narrow target into a broad landscape of potential vulnerabilities.
Prediction:
The automation and sophistication of subdomain enumeration will continue to accelerate, pushing organizations towards more dynamic and opaque defense strategies like ephemeral infrastructure and widespread use of wildcard DNS. In response, enumeration tools will increasingly incorporate machine learning to predict subdomain names and federate with cloud provider APIs for direct asset discovery, blurring the line between passive and active reconnaissance and making comprehensive attack surface management an even more complex challenge.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ajay Chaudhary – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
