SubdomainEnum

SubdomainEnum

Subdomain enumeration following Jason Haddix's Bug Hunter's Methodology (TBHM), with intelligent target prioritization.

Philosophy:

"For every subdomain you find, you 2x your chance of hacking the target. For every apex domain you find, you 4x your chance of hacking the target." — Jason Haddix

Workflow Routing

When executing, announce:

Running the **Light** workflow from **SubdomainEnum**...

Light Workflow (Default)

When to use: Quick reconnaissance, time-sensitive, initial target assessment.

Time: 1-5 minutes

Tools: subfinder, httpx, PrioritizeTargets

Steps

1. Create output directory:

mkdir -p recon_{domain}_{timestamp}
cd recon_{domain}_{timestamp}

2. Run subfinder with all sources:

subfinder -d {domain} -all -o subdomains-raw.txt

3. Deduplicate and sort:

sort -u subdomains-raw.txt > subdomains.txt
echo "Found $(wc -l < subdomains.txt) subdomains"

4. Probe with httpx (JSON for prioritization):

httpx -l subdomains.txt -silent -status-code -title -tech-detect -json -o probe.json
httpx -l subdomains.txt -silent -o live.txt
echo "$(wc -l < live.txt) live hosts"

5. Generate prioritized report:

bun ~/clawd/skills/SubdomainEnum/tools/PrioritizeTargets.ts \
  --input probe.json --output report.md

6. Report summary to user:

Found X subdomains, Y are live.
🔴 CRITICAL: N targets
🟠 HIGH: N targets  
🟡 MEDIUM: N targets
⚪ LOW: N targets

Top targets:
1. admin.target.com (Score: 95) - Admin panel
2. api-staging.target.com (Score: 82) - Dev environment + API
3. jenkins.target.com (Score: 78) - CI/CD exposed

Output

recon_{domain}_{timestamp}/
├── subdomains-raw.txt      # Raw subfinder output
├── subdomains.txt          # Deduplicated list
├── probe.json              # httpx JSON (for prioritization)
├── live.txt                # Live hosts
└── report.md               # Prioritized target report

Full Workflow

When to use: Bug bounty, comprehensive audits, maximum coverage.

Time: 10-60 minutes (depends on target size)

Tools: subfinder, assetfinder, amass, github-subdomains, subbdom-cli, httpx, PrioritizeTargets (optional: puredns, dnsgen)

Phase 0: Apex Domain Discovery (Optional)

If targeting a Microsoft 365/Azure organization, discover related apex domains first:

tenant-domains -d {domain} -o apex_domains.txt

If not Microsoft, create apex_domains.txt with initial domain:

echo "{domain}" > apex_domains.txt

Phase 1: Passive Collection (Parallel)

Run all passive tools simultaneously for each apex domain:

# Terminal 1: Subfinder
subfinder -d {domain} -all -o subfinder.txt

# Terminal 2: Assetfinder  
assetfinder --subs-only {domain} > assetfinder.txt

# Terminal 3: GitHub Subdomains (requires GITHUB_TOKEN)
github-subdomains -d {domain} -e -o github.txt

# Terminal 4: Amass (passive mode, with timeout)
timeout 30m amass enum -passive -d {domain} -o amass.txt

# Terminal 5: Subbdom (requires API key in ~/.subbdom-cli.yaml)
# Linux binary on VPS - run via SSH or install locally
ssh root@207.244.244.11 "~/tools/subbdom-cli/subbdom-cli -z {domain}" > subbdom.txt

For multiple apex domains:

while read domain; do
  subfinder -d "$domain" -all >> subfinder.txt &
  assetfinder --subs-only "$domain" >> assetfinder.txt &
  github-subdomains -d "$domain" -e >> github.txt &
  timeout 30m amass enum -passive -d "$domain" >> amass.txt &
done < apex_domains.txt
wait

Phase 2: Aggregation

Combine and deduplicate all results:

cat subfinder.txt assetfinder.txt github.txt amass.txt subbdom.txt 2>/dev/null | \
  sort -u > subdomains.txt

# Generate stats
echo "=== TOOL STATISTICS ==="
echo "Subfinder:   $(wc -l < subfinder.txt 2>/dev/null || echo 0)"
echo "Assetfinder: $(wc -l < assetfinder.txt 2>/dev/null || echo 0)"
echo "GitHub:      $(wc -l < github.txt 2>/dev/null || echo 0)"
echo "Amass:       $(wc -l < amass.txt 2>/dev/null || echo 0)"
echo "Subbdom:     $(wc -l < subbdom.txt 2>/dev/null || echo 0)"
echo "Total unique: $(wc -l < subdomains.txt)"

Phase 3: DNS Resolution (Optional but Recommended)

Verify subdomains resolve:

cat subdomains.txt | dnsx -silent > resolved.txt

Phase 4: Permutation/Brute Force (Optional)

For maximum coverage:

# Generate permutations with dnsgen
cat resolved.txt | dnsgen - > permutations.txt

# Resolve permutations
puredns resolve permutations.txt -r resolvers.txt -w permutation-resolved.txt

# Add new findings
cat resolved.txt permutation-resolved.txt | sort -u > all-resolved.txt

Phase 5: HTTP Probing

httpx -l subdomains.txt -silent -status-code -title -tech-detect \
  -json -o probe.json

httpx -l subdomains.txt -silent -o live.txt

Phase 6: Target Prioritization

bun ~/clawd/skills/SubdomainEnum/tools/PrioritizeTargets.ts \
  --input probe.json --output report.md

Output Structure

recon_{domain}_{timestamp}/
├── apex_domains.txt        # All apex domains (if tenant-domains used)
├── subfinder.txt           # Subfinder results
├── assetfinder.txt         # Assetfinder results
├── github.txt              # GitHub results
├── amass.txt               # Amass results
├── subdomains.txt          # Aggregated, deduplicated
├── resolved.txt            # DNS-verified subdomains
├── probe.json              # httpx JSON output
├── live.txt                # Live HTTP/S hosts
├── report.md               # Prioritized target report
└── high-value.txt          # Quick grep of interesting targets

Target Prioritization

The PrioritizeTargets engine scores every live host and generates a prioritized report.

Scoring Criteria

CRITICAL (Score 90-100):

• Admin panels, dashboards, consoles
• Authentication servers (SSO, SAML, OAuth)
• Internal tools exposed (Jenkins, Grafana, Kibana, Prometheus)
• Cloud management consoles

HIGH (Score 70-89):

• Development/staging environments
• API endpoints (GraphQL, REST, Swagger, OpenAPI)
• File upload/storage endpoints
• Database interfaces (phpMyAdmin, Adminer)

MEDIUM (Score 50-69):

• Partner/vendor portals
• Mobile backends
• Legacy systems
• Sites with interesting technologies

LOW (Score <50):

• Static marketing sites
• CDN nodes
• Redirects to main domain
• 404 responses

Technology Scoring

Status Code Scoring

Tool Installation

# All tools via Go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/tomnomnom/assetfinder@latest
go install -v github.com/owasp-amass/amass/v4/...@master
go install -v github.com/gwen001/github-subdomains@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install -v github.com/d3mondev/puredns/v2@latest

# Prioritization script requires bun
curl -fsSL https://bun.sh/install | bash

API Keys Configuration

API keys dramatically improve coverage. Configure in ~/.config/subfinder/provider-config.yaml:

securitytrails: [YOUR_API_KEY]
shodan: [YOUR_API_KEY]  
censys: [YOUR_API_KEY:YOUR_SECRET]
virustotal: [YOUR_API_KEY]
chaos: [YOUR_API_KEY]
github: [YOUR_TOKEN]

Quick Reference

Examples

Example 1: Light enumeration (default)

User: "Find subdomains for target.com"
→ Light workflow
→ subfinder -all → httpx → prioritize
→ "Found 234 subdomains, 156 live.
   🔴 CRITICAL: 3 | 🟠 HIGH: 12 | 🟡 MEDIUM: 45 | ⚪ LOW: 96
   Top: admin.target.com (95), api-dev.target.com (82)"

Example 2: Full enumeration

User: "Do full subdomain enumeration on example.org"
→ Full workflow
→ All tools parallel → aggregate → httpx → prioritize
→ "Found 1,547 unique subdomains. 892 live.
   🔴 CRITICAL: 8 | 🟠 HIGH: 34 | 🟡 MEDIUM: 156 | ⚪ LOW: 694
   Tool breakdown: subfinder 789, assetfinder 456, github 523, amass 1203"

Example 3: Quick recon with report

User: "Quick recon on target.com, prioritize targets"
→ Light workflow (prioritization always included)
→ Outputs report.md with CRITICAL→LOW targets and attack surface notes