Subdomain and Asset Discovery

⚠️ Authorized testing only. Everything here is for use only against systems you own or have explicit written permission to test — home labs, CTFs, and authorized engagements. Unauthorized access is illegal. See Rules of Engagement and Authorization.

You can only test what you can find. Subdomain enumeration expands a single domain into the full attack surface — forgotten dev hosts, staging panels, and APIs.

#Passive enumeration

subfinder -d example.com -all -silent -o subs.txt
amass enum -passive -d example.com -o amass.txt
sort -u subs.txt amass.txt -o all-subs.txt

#Active resolution & brute force

# brute-force with a wordlist, then resolve
puredns bruteforce subdomains-top1m.txt example.com -r resolvers.txt
dnsx -l all-subs.txt -resp -o resolved.txt

#Find what's actually alive

httpx -l all-subs.txt -title -status-code -tech-detect -o live.txt

Workflow: passive → brute → resolve → probe-live → screenshot (gowitness). Feed live hosts into Directory and Vhost Fuzzing. Use a lab target to practice.