Subdomain Enumeration

Each of an organization’s subdomains (mail., dev., vpn., jira., admin.) is a potential door, and often the weakest: forgotten, staging, or third-party-service subdomains tend to be worse protected than the main domain. Enumerating subdomains widens the attack surface, and it’s one of the first recon steps because each finding opens new lines of work.

Three approaches (complementary)

All three are combined for maximum coverage: passive (third-party sources), brute force (dictionary against DNS), and permutations (variations of what’s found).

Passive (without touching the target)

# aggregators of many sources
subfinder -d target.com -all -silent
amass enum -passive -d target.com
# Certificate Transparency: certificates reveal subdomains
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u
# others: SecurityTrails, VirusTotal, Censys, DNSdumpster

Certificate Transparency (crt.sh) is especially powerful: every issued certificate lands in public logs, revealing internal subdomains that were never published.

DNS brute force

Try a dictionary of common names against the target’s DNS:

# fast tools with resolvers
puredns bruteforce subs.txt target.com -r resolvers.txt
gobuster dns -d target.com -w subdomains.txt
ffuf -w subs.txt -u https://FUZZ.target.com     # by HTTP response
# typical wordlists: SecLists (DNS/)

Permutations and alterations

From what’s found, generate variations (dev1, dev-api, api.dev):

# generate permutations and resolve them
gotator / altdns / dnsgen  +  puredns resolve

Resolve and filter live ones

A subdomain in a list is useless if it doesn’t resolve or respond:

# resolve (does it have an IP?) then does it respond over HTTP?
dnsx -l subs.txt -a -resp          # resolve
httpx -l resolved.txt -title -status-code -tech-detect   # live? what is it?

What to do with subdomains

Subdomain takeover: does any CNAME point to a released third-party service? (see Subdomain takeover).
Staging/dev environments: tend to have fewer controls, default credentials, debug on.
Admin panels, APIs, VPN: authentication surface.
Different technologies per subdomain → individual fingerprint (Technology Fingerprinting).

Virtual hosts (vhosts)

Several sites on the same IP are distinguished by the Host header. There may be vhosts not listed in DNS:

ffuf -w vhosts.txt -u https://target.com -H "Host: FUZZ.target.com" -fs <base_size>
gobuster vhost -u https://target.com -w vhosts.txt

For the defense

Reduce exposure: don’t leave dev/staging subdomains reachable from the Internet, clean up stale DNS records (prevents takeovers), monitor Certificate Transparency to detect unexpected certificates/subdomains, and apply the same controls to the humblest subdomain as to the main one.

Testing checklist

Passive enumeration (subfinder/amass/crt.sh)
DNS brute force with a good dictionary (SecLists)
Permutations of what’s found (gotator/dnsgen)
Resolve and filter live ones (dnsx + httpx)
Look for subdomain takeover (dangling CNAMEs)
Identify staging/dev/admin/API/VPN
Discover vhosts by Host header
Individual fingerprint of each interesting subdomain