<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-subdomain-enumeration
description: >-
  Perform comprehensive subdomain enumeration using passive and active techniques to map attack surface.
domain: cybersecurity
subdomain: bug-bounty
tags:
  - subdomain
  - enumeration
  - dns
  - reconnaissance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595.002", "T1590.002"]
---

# Conducting Subdomain Enumeration

## Overview

Perform comprehensive subdomain enumeration using passive and active techniques to map attack surface.

## Prerequisites

| Requirement | Install |
|---|---|
| subfinder | `go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest` |
| dnsx | `go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest` |
| Python 3.10+ | For agent tooling |

## Key Concepts

Subdomain enumeration discovers all subdomains using passive sources
and active methods (brute-force, zone transfer, permutations).

## Quick Reference

```bash
subfinder -d target.com -all -o subs.txt
cat subs.txt | dnsx -resp -o resolved.txt
node agent.js enumerate --domain target.com --method all
node agent.js resolve --input subs.txt --output resolved.json
```

## Workflow

1. Passive enumeration
2. CT log collection
3. DNS brute-forcing
4. Generate permutations
5. Resolve to IPs
6. Check takeover
7. Deduplicate

## Verification

- Verify passive sources
- Confirm DNS resolution
- Validate brute-force
- Check takeover detection
- Verify deduplication

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
