<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-subdomain-enumeration
description: >-
  Enumerate subdomains using passive sources, certificate transparency logs,
  DNS brute-forcing, and permutation techniques to map an organization's
  external attack surface.
domain: cybersecurity
subdomain: osint-recon
tags:
  - subdomain
  - enumeration
  - certificate-transparency
  - dns-bruteforce
  - attack-surface
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  subfinder, amass, assetfinder, dnsx, httpx, puredns, gotator, altdns,
  bbot, crt.sh, SecurityTrails API.
metadata:
  mitre-attack:
    - "T1595.002"  # Active Scanning: Vulnerability Scanning
    - "T1596.002"  # Search Open Technical Databases: WHOIS/DNS
    - "T1593"      # Search Open Websites/Domains
---

# Performing Subdomain Enumeration

## Overview

Subdomain enumeration discovers hostnames under a target domain to map the
external attack surface. Techniques range from fully passive (CT logs, search
engines, threat intel feeds) to active (DNS brute-forcing, zone transfers,
permutation generation). A complete enumeration combines multiple sources and
resolves results to filter live hosts.

## Prerequisites

- subfinder with API keys configured (`~/.config/subfinder/provider-config.yaml`)
- amass v4+, assetfinder, findomain for multi-source enumeration
- dnsx, httpx from ProjectDiscovery for resolution and probing
- puredns with massdns for high-speed DNS brute-forcing
- gotator or altdns for subdomain permutation generation
- SecLists wordlists at `/usr/share/seclists/`
- API keys: SecurityTrails, Shodan, Censys, VirusTotal (optional but recommended)

```bash
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
pip install requests dnspython
```

## Quick Reference

| Task | Command |
|------|---------|
| Passive enum | `subfinder -d target.com -silent -all -o subs.txt` |
| Amass passive | `amass enum -passive -d target.com -o amass_subs.txt` |
| CT log query | `curl -s "https://crt.sh/?q=%.target.com&output=json" \| jq -r '.[].name_value' \| sort -u` |
| DNS brute-force | `puredns bruteforce wordlist.txt target.com -r resolvers.txt -w brute.txt` |
| Permutation | `gotator -sub subs.txt -perm permutations.txt -depth 1 -numbers 3 -md5 \| dnsx -silent` |
| Resolve subs | `dnsx -l subs.txt -silent -a -resp -o resolved.txt` |
| HTTP probe | `httpx -l resolved.txt -silent -sc -title -tech-detect -o live.txt` |
| Merge & dedup | `cat subfinder.txt amass.txt brute.txt \| sort -u > all_subs.txt` |

## Workflow

### Step 1: Passive Subdomain Collection

Gather subdomains without touching the target infrastructure.

```bash
# Subfinder — aggregates 40+ passive sources
subfinder -d target.com -silent -all -o subfinder.txt

# Amass passive mode
amass enum -passive -d target.com -o amass.txt

# Assetfinder
assetfinder --subs-only target.com > assetfinder.txt

# Certificate Transparency via crt.sh
curl -s "https://crt.sh/?q=%.target.com&output=json" \
  | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > crtsh.txt

# SecurityTrails API
curl -s -H "apikey: $ST_KEY" \
  "https://api.securitytrails.com/v1/domain/target.com/subdomains" \
  | jq -r '.subdomains[]' | sed "s/$/.target.com/" > sectrails.txt
```

### Step 2: Active DNS Brute-Forcing

```bash
# PureDNS with massdns backend — resolves while brute-forcing
puredns bruteforce /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
  target.com -r resolvers.txt -w brute_results.txt

# DNSx brute-force mode
dnsx -d target.com -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt \
  -silent -a -resp -o dnsx_brute.txt
```

### Step 3: Subdomain Permutation

```bash
# Gotator — generate permutations from known subdomains
gotator -sub known_subs.txt -perm /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt \
  -depth 1 -numbers 3 -md5 > permutations.txt

# Resolve permutations
puredns resolve permutations.txt -r resolvers.txt -w perm_resolved.txt
```

### Step 4: Merge, Resolve, and Probe

```bash
# Merge all sources
cat subfinder.txt amass.txt assetfinder.txt crtsh.txt sectrails.txt \
  brute_results.txt perm_resolved.txt | sort -u > all_subdomains.txt

# DNS resolution — filter to live hosts
dnsx -l all_subdomains.txt -silent -a -resp -o resolved.txt

# HTTP probing — identify web services
httpx -l resolved.txt -silent -sc -title -tech-detect -fr -o live_web.txt
```

### Step 5: Subdomain Takeover Check

```bash
# Check for dangling CNAMEs
dnsx -l all_subdomains.txt -cname -resp -o cnames.txt

# Nuclei takeover templates
nuclei -l live_web.txt -t /root/nuclei-templates/http/takeovers/ -o takeovers.txt
```

## Detection Opportunities

- High-volume DNS queries from a single source indicate brute-forcing
- Rapid A-record lookups for non-existent subdomains (NXDOMAIN flood)
- CT log monitoring services can alert on new certificate issuance
- WAF/CDN logs show reconnaissance patterns from HTTP probing

## Verification

- [ ] Multiple passive sources queried and results merged
- [ ] DNS brute-forcing performed with quality wordlist
- [ ] All subdomains resolved — dead hosts filtered out
- [ ] HTTP probing identifies live web services with tech stack
- [ ] Subdomain takeover candidates identified via dangling CNAMEs
- [ ] Results deduplicated and tagged with discovery source

## References

- [Subfinder](https://github.com/projectdiscovery/subfinder)
- [Amass](https://github.com/owasp-amass/amass)
- [PureDNS](https://github.com/d3mondev/puredns)
- [Gotator](https://github.com/Josue87/gotator)
- [crt.sh](https://crt.sh/)
- [SecurityTrails API](https://securitytrails.com/corp/apidocs)

---
v1.0 | Validated: 2026-03-17
