How do I install the Recon Subdomain Enum skill?

Run npx skillmds@latest add noorqureshi/recon-subdomain-enum in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Recon Subdomain Enum safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Recon Subdomain Enum?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Recon Subdomain Enum free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Recon Subdomain Enum?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Recon Subdomain Enum by noorqureshi

Name: Recon Subdomain Enum
Author: NoorQureshi

Recon Subdomain Enum

Enumerate subdomains and live hosts to build the attack surface for a bug-bounty program or external assessment. Load at engagement start, on "recon", a root domain in scope, "find subdomains", or before content discovery. Signals: wildcard scope (*.target.com), a program scope list, a new external target.

NoorQureshi 1481aa1 2.1 KB Updated Sep 17, 2026

File contents

Subdomain & live-host enumeration

When it applies

External, in-scope, wildcard programs where surface = subdomains. Do this before hunting; most bugs live on forgotten hosts (staging, dev, legacy, acquisitions).

Why it works

Organizations sprint faster than they inventory. Passive sources (CT logs, DNS aggregators) plus permutation/brute-force surface hosts nobody remembers — and those skip the hardening the flagship app got.

Method

Passive (fast, quiet): subfinder -d target.com -all -silent and amass enum -passive -d target.com. Pulls CT logs, PassiveDNS, search engines — no packets to the target.
Resolve & dedupe: dnsx -l subs.txt -a -resp -silent to keep only records that resolve (drops dead CT noise) and grab their IPs.
Brute/permute for hidden hosts: puredns/shuffledns with a DNS wordlist + dnsgen permutations (dev-, -staging, region prefixes) against resolvers.
Probe live web: httpx -l resolved.txt -sc -title -tech-detect -cdn -silent → status, title, tech, CDN. This is your ranked target list.
Port sweep where allowed: naabu -l hosts.txt -top-ports 1000 to find non-web services.

Gotchas

Wildcard DNS (*.target.com → one IP) creates false positives — filter with dnsx/puredns wildcard detection before trusting a hit.
Confirm each host is in program scope before probing; out-of-scope acquisitions are a trap.
CDN/WAF IPs are shared — don't port-scan Cloudflare ranges; find origin instead.

Verify success

A deduplicated list of resolving, in-scope hosts with status/title/tech — the input to content discovery and per-class hunting.

References

ProjectDiscovery docs (subfinder/httpx/dnsx/naabu); OWASP Amass; TomNomNom recon workflow.

---name: recon-subdomain-enumdescription: Enumerate subdomains and live hosts to build the attack surface for a bug-bounty program or external assessment. Load at engagement start, on "recon", a root domain in scope, "find subdomains", or before content discovery. Signals: wildcard scope (*.target.com), a program scope list, a new external target.---# Subdomain & live-host enumeration## When it appliesExternal, in-scope, wildcard programs where surface = subdomains. Do this before hunting;most bugs live on forgotten hosts (staging, dev, legacy, acquisitions).## Why it worksOrganizations sprint faster than they inventory. Passive sources (CT logs, DNS aggregators)plus permutation/brute-force surface hosts nobody remembers — and those skip the hardeningthe flagship app got.## Method1. **Passive** (fast, quiet): `subfinder -d target.com -all -silent` and `amass enum -passive -d target.com`. Pulls CT logs, PassiveDNS, search engines — no packets to the target.2. **Resolve & dedupe**: `dnsx -l subs.txt -a -resp -silent` to keep only records that resolve (drops dead CT noise) and grab their IPs.3. **Brute/permute** for hidden hosts: `puredns`/`shuffledns` with a DNS wordlist + `dnsgen` permutations (`dev-`, `-staging`, region prefixes) against resolvers.4. **Probe live web**: `httpx -l resolved.txt -sc -title -tech-detect -cdn -silent` → status, title, tech, CDN. This is your ranked target list.5. **Port sweep** where allowed: `naabu -l hosts.txt -top-ports 1000` to find non-web services.## Gotchas- Wildcard DNS (`*.target.com` → one IP) creates false positives — filter with `dnsx`/`puredns` wildcard detection before trusting a hit.- Confirm each host is **in program scope** before probing; out-of-scope acquisitions are a trap.- CDN/WAF IPs are shared — don't port-scan Cloudflare ranges; find origin instead.## Verify successA deduplicated list of resolving, in-scope hosts with status/title/tech — the input tocontent discovery and per-class hunting.## ReferencesProjectDiscovery docs (subfinder/httpx/dnsx/naabu); OWASP Amass; TomNomNom recon workflow.

Frequently asked questions