skills.rest
braydos-h
braydos-hCOMMUNITY
Explore all skills by this author →
GitHub

performing-subdomain-enumeration-with-subfinder

Enumerate subdomains with Subfinder and validate live hosts using httpx and dnsx.

4|Updated Apr 28, 2026
Search Tags:#reconnaissance#subdomain enumeration#httpx#attack surface#osint#bug bounty#subfinder
One-click install
npx skills add https://github.com/braydos-h/BreachPilot --skill performing-subdomain-enumeration-with-subfinder-braydos-h
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-subdomain-enumeration-with-subfinder
Source: https://github.com/braydos-h/BreachPilot/tree/main/skills/performing-subdomain-enumeration-with-subfinder
Command: npx skills add https://github.com/braydos-h/BreachPilot --skill performing-subdomain-enumeration-with-subfinder-braydos-h

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve? Security teams and bug bounty hunters need a complete map of a target's external attack surface, but manually discovering subdomains across passive DNS sources, certificate transparency logs, and threat intel APIs is slow and error-prone. ## Core Features & Use Cases - Passive Subdomain Discovery: Runs ProjectDiscovery Subfinder across multiple passive sources (crt.sh, Shodan, VirusTotal, Censys, SecurityTrails, Chaos) with configurable rate limits and source filtering. - Live Host Validation: Pipes discovered subdomains through httpx for HTTP status, titles, and technology detection, plus dnsx for DNS resolution. - Takeover Risk Detection: Identifies subdomains with CNAME records pointing to claimable cloud services like AWS, Azure, Heroku, and GitHub Pages. - Use Case: During a bug bounty engagement, enumerate all subdomains of an in-scope domain, validate which are live, flag takeover candidates, and generate a Markdown report for the assessment. ## Quick Start Ask the agent to enumerate subdomains for example.com, validate the live hosts, and produce an attack surface report.

Frequently Asked Questions about performing-subdomain-enumeration-with-subfinder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains with Subfinder?▼

Run subfinder with the -d flag followed by the target domain, for example subfinder -d example.com -o subdomains.txt. Add -all to query every passive source or -silent to pipe clean output into tools like httpx.

How to validate live subdomains after enumeration?▼

Pipe Subfinder output into httpx to probe HTTP services and capture status codes, page titles, and detected technologies. Use dnsx to resolve A and CNAME records for the discovered hosts.

Does Subfinder require API keys to work?▼

Subfinder works without keys using free sources like crt.sh and AlienVault OTX, but API keys for Shodan, Censys, VirusTotal, SecurityTrails, and Chaos significantly increase coverage. Keys are configured in $HOME/.config/subfinder/provider-config.yaml.

How do I detect subdomain takeover vulnerabilities?▼

Check CNAME records of discovered subdomains against known claimable services such as amazonaws.com, herokuapp.com, github.io, and azurewebsites.net. The included scripts automate this by resolving CNAMEs with dig or dnsx and flagging matches.

Is passive subdomain enumeration legal to perform?▼

Passive enumeration queries public databases and certificate transparency logs without touching target infrastructure, so it is generally legal. Always confirm scope and authorization before moving to active scanning or exploitation.

Related Skills

Explore More Software Engineering Skills→
dreadnodedreadnode
11

hackerone-recon

Enumerate HackerOne program scope and generate prioritized target inventories.

Official
Intermediate
mindfortaimindfortai
16

finding-review

Triage cybersecurity findings for validity, exploitability, impact, and evidence quality.

Official
Advanced
zebbernzebbern
5

subdomain-enum

Enumerate subdomains with Subfinder, Amass, and Httpx pipelines.

Community
Advanced
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced