Enumerate Subdomains from Traffic
Analyze the mitmproxy dump (log.txt) and enumerate subdomains for: $ARGUMENTS
Requires: log.txt in the current directory. If it's missing, capture traffic first:
mitmdump --set flow_detail=3 2>&1 | tee log.txt
Tasks
1. Extract Seen Subdomains
- List all subdomains from captured traffic
- Note the purpose of each (API, CDN, auth, etc.)
2. Identify Patterns
- Common prefixes: api., admin., staging., dev.
- Environment indicators: prod., uat., test.
- Service patterns: auth., pay., cdn.
3. Suggest More to Discover
Based on patterns, suggest testing:
api, admin, dashboard, portal, internal, staging, dev, test, qa
beta, alpha, demo, sandbox, uat, preprod, prod
mail, email, smtp, mx, webmail
cdn, static, assets, media, images, files
db, database, mysql, postgres, mongo, redis
auth, login, sso, oauth, identity
pay, payment, checkout, billing, invoice
mobile, m, app, ios, android
docs, documentation, help, support, wiki
analytics, metrics, stats, monitor, grafana
jenkins, gitlab, github, ci, build
vpn, remote, gateway, proxy
console, panel, backend, cms, manage
Output Format
For each discovered subdomain:
- Subdomain: Full URL
- Type: API/CDN/Auth/Admin/etc.
- Visibility: Internal/External facing
- Risk: Flag sensitive ones
Also Check For
- Cloud storage buckets (s3, gcs, azure blob)
- Third-party services with company data
- Debug/test endpoints that shouldn't be public
- Old/deprecated subdomains still active
1---2name: mitm-subdomains3description: Enumerate subdomains from captured traffic. Use when user asks about subdomain discovery, attack surface mapping, or domain reconnaissance.4---56# Enumerate Subdomains from Traffic78Analyze the mitmproxy dump (log.txt) and enumerate subdomains for: $ARGUMENTS910> **Requires**: `log.txt` in the current directory. If it's missing, capture traffic first:11> ```bash12> mitmdump --set flow_detail=3 2>&1 | tee log.txt13> ```1415## Tasks1617### 1. Extract Seen Subdomains18- List all subdomains from captured traffic19- Note the purpose of each (API, CDN, auth, etc.)2021### 2. Identify Patterns22- Common prefixes: api., admin., staging., dev.23- Environment indicators: prod., uat., test.24- Service patterns: auth., pay., cdn.2526### 3. Suggest More to Discover27Based on patterns, suggest testing:28```29api, admin, dashboard, portal, internal, staging, dev, test, qa30beta, alpha, demo, sandbox, uat, preprod, prod31mail, email, smtp, mx, webmail32cdn, static, assets, media, images, files33db, database, mysql, postgres, mongo, redis34auth, login, sso, oauth, identity35pay, payment, checkout, billing, invoice36mobile, m, app, ios, android37docs, documentation, help, support, wiki38analytics, metrics, stats, monitor, grafana39jenkins, gitlab, github, ci, build40vpn, remote, gateway, proxy41console, panel, backend, cms, manage42```4344## Output Format4546For each discovered subdomain:47- **Subdomain**: Full URL48- **Type**: API/CDN/Auth/Admin/etc.49- **Visibility**: Internal/External facing50- **Risk**: Flag sensitive ones5152## Also Check For53- Cloud storage buckets (s3, gcs, azure blob)54- Third-party services with company data55- Debug/test endpoints that shouldn't be public56- Old/deprecated subdomains still active
instavm