How do I install the Subdomain Enum skill?

Run npx skillmds@latest add dvcrn/subdomain-enum in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Subdomain Enum safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Subdomain Enum?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Subdomain Enum free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Subdomain Enum?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Subdomain Enum by dvcrn — Agent Skill

Name: Subdomain Enum
Rating: 4.2 (5 reviews)
Author: dvcrn

Subdomain Enum

Enumerate subdomains for any domain using DNS brute-force and certificate transparency logs (crt.sh). Use when a user needs to discover subdomains, perform reconnaissance, audit attack surface, find forgotten or exposed services, or map the infrastructure of a domain. No API keys required. Supports custom wordlists, concurrent threads, and JSON output.

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

Subdomain Enumerator

Discover subdomains for any domain using two complementary techniques: DNS brute-force resolution and certificate transparency log mining via crt.sh.

Quick Start

python3 scripts/subenum.py example.com

Commands

# Basic enumeration (built-in wordlist + crt.sh)
python3 scripts/subenum.py example.com

# Custom wordlist
python3 scripts/subenum.py example.com --wordlist /path/to/wordlist.txt

# Faster with more threads
python3 scripts/subenum.py example.com --threads 20

# DNS only (skip crt.sh)
python3 scripts/subenum.py example.com --no-crtsh

# JSON output
python3 scripts/subenum.py example.com --json

# Save results to file
python3 scripts/subenum.py example.com --output subdomains.txt

# Verbose progress
python3 scripts/subenum.py example.com -v

Options

Flag	Default	Description
`--wordlist, -w`	built-in (~120 words)	Custom wordlist file
`--threads, -t`	`10`	Concurrent DNS resolution threads
`--timeout`	`15`	HTTP timeout for crt.sh query
`--no-crtsh`	off	Skip certificate transparency lookup
`--json`	off	Output as JSON
`--output, -o`	—	Write results to file
`--verbose, -v`	off	Show progress during scan

Techniques

DNS Brute-force — Resolves {word}.{domain} against DNS for each word in the wordlist. Returns IP addresses for live subdomains.
Certificate Transparency (crt.sh) — Queries public CT logs for certificates issued to *.domain, revealing subdomains that may not respond to DNS but have had TLS certificates.

Dependencies

pip install requests

Notes

Built-in wordlist covers common subdomains (www, api, mail, staging, etc.)
For comprehensive scans, use a larger wordlist (e.g., SecLists DNS wordlists)
Results are deduplicated across sources
Use responsibly — only scan domains you own or have authorization to test

---name: subdomain-enumdescription: Enumerate subdomains for any domain using DNS brute-force and certificate transparency logs (crt.sh). Use when a user needs to discover subdomains, perform reconnaissance, audit attack surface, find forgotten or exposed services, or map the infrastructure of a domain. No API keys required. Supports custom wordlists, concurrent threads, and JSON output.---# Subdomain EnumeratorDiscover subdomains for any domain using two complementary techniques: DNS brute-force resolution and certificate transparency log mining via crt.sh.## Quick Start```bashpython3 scripts/subenum.py example.com```## Commands```bash# Basic enumeration (built-in wordlist + crt.sh)python3 scripts/subenum.py example.com# Custom wordlistpython3 scripts/subenum.py example.com --wordlist /path/to/wordlist.txt# Faster with more threadspython3 scripts/subenum.py example.com --threads 20# DNS only (skip crt.sh)python3 scripts/subenum.py example.com --no-crtsh# JSON outputpython3 scripts/subenum.py example.com --json# Save results to filepython3 scripts/subenum.py example.com --output subdomains.txt# Verbose progresspython3 scripts/subenum.py example.com -v```## Options| Flag | Default | Description ||------|---------|-------------|| `--wordlist, -w` | built-in (~120 words) | Custom wordlist file || `--threads, -t` | `10` | Concurrent DNS resolution threads || `--timeout` | `15` | HTTP timeout for crt.sh query || `--no-crtsh` | off | Skip certificate transparency lookup || `--json` | off | Output as JSON || `--output, -o` | — | Write results to file || `--verbose, -v` | off | Show progress during scan |## Techniques1. **DNS Brute-force** — Resolves `{word}.{domain}` against DNS for each word in the wordlist. Returns IP addresses for live subdomains.2. **Certificate Transparency (crt.sh)** — Queries public CT logs for certificates issued to `*.domain`, revealing subdomains that may not respond to DNS but have had TLS certificates.## Dependencies```bashpip install requests```## Notes- Built-in wordlist covers common subdomains (www, api, mail, staging, etc.)- For comprehensive scans, use a larger wordlist (e.g., SecLists DNS wordlists)- Results are deduplicated across sources- Use responsibly — only scan domains you own or have authorization to test

Frequently asked questions