Subdomain Enumeration
Passive Enumeration (no direct target contact)
# Certificate Transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u
# Subfinder — multi-source passive
subfinder -d target.com -all -o passive.txt
# Amass passive
amass enum -passive -d target.com -o amass-passive.txt
# OSINT sources
assetfinder --subs-only target.com
findomain -t target.com
# GitHub search
curl "https://api.github.com/search/code?q=target.com&type=code" \
-H "Authorization: token GITHUB_TOKEN" | jq '.items[].html_url'
Active Enumeration (DNS queries to target)
# DNS brute force with PureDNS (fast, handles wildcard)
puredns bruteforce /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt \
target.com -r resolvers.txt -o active.txt
# Gobuster DNS
gobuster dns -d target.com \
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
-t 50 -o gobuster.txt
Permutation (discover missed subdomains)
# Gotator — permutation from discovered subdomains
gotator -sub passive.txt -perm /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt \
-depth 1 -numbers 3 > permutations.txt
puredns resolve permutations.txt -r resolvers.txt -o resolved-permutations.txt
Live Host Filtering
# Combine all results
cat passive.txt active.txt resolved-permutations.txt | sort -u > all-subdomains.txt
# Resolve and check HTTP
httpx -l all-subdomains.txt -status-code -title -tech-detect -o live-hosts.txt
# Screenshot all live hosts
gowitness file -f live-hosts.txt
Subdomain Takeover Detection
# Nuclei subdomain takeover templates
nuclei -l live-hosts.txt -t ~/nuclei-templates/takeovers/ -o takeovers.txt
# Manual: check CNAME records pointing to unclaimed services
# (AWS S3, Heroku, GitHub Pages, Fastly, Azure)
for sub in $(cat live-hosts.txt); do
cname=$(dig CNAME $sub +short)
if [ -n "$cname" ]; then echo "$sub → $cname"; fi
done
Tools
sunilgentyala