skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-subdomain-enumeration-with-subfinder

Enumerate subdomains of target domains using Subfinder passive reconnaissance sources.

1|1|Updated Apr 3, 2026
Search Tags:#reconnaissance#subdomain enumeration#attack surface#osint#bug bounty#subfinder#passive recon
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill performing-subdomain-enumeration-with-subfinder-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-subdomain-enumeration-with-subfinder
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/recon/performing-subdomain-enumeration-with-subfinder
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill performing-subdomain-enumeration-with-subfinder-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers and bug bounty hunters need a complete map of a target's external attack surface, but manually discovering subdomains across dozens of passive data sources is slow and incomplete. This Skill provides a structured workflow for enumerating subdomains with Subfinder and validating the results. ## Core Features & Use Cases - Passive Subdomain Enumeration: Query certificate transparency logs, DNS aggregators, and APIs like Shodan, Censys, and VirusTotal through Subfinder with configurable source selection and rate limiting. - Live Host Validation: Pipe discovered subdomains into httpx and dnsx to confirm which hosts are live, resolve IPs, and detect technologies. - Pipeline Integration: Chain results into Nuclei for vulnerability scanning, combine with Amass for broader coverage, or capture screenshots with gowitness. - Use Case: During a bug bounty engagement, enumerate all subdomains of an in-scope domain, validate live hosts, and feed them into a vulnerability scan to find forgotten or misconfigured assets. ## Quick Start Ask the agent to enumerate subdomains for example.com using Subfinder and validate the live hosts with httpx.

Frequently Asked Questions about performing-subdomain-enumeration-with-subfinder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains with Subfinder?▼

Run subfinder with the -d flag followed by the target domain, for example subfinder -d example.com -o subdomains.txt. Use -all to query every passive source or -s to select specific sources like crtsh, virustotal, and shodan.

How to find live subdomains after enumeration?▼

Pipe Subfinder output into httpx to validate which hosts respond, for example subfinder -d example.com -silent | httpx -silent -status-code. You can add -title and -tech-detect to capture page titles and technologies.

Subfinder vs Amass for subdomain enumeration?▼

Subfinder focuses on fast passive enumeration from external sources, while Amass supports both passive and active techniques with deeper graph analysis. The workflow combines both tools and deduplicates results with sort -u for broader coverage.

Does Subfinder require API keys to work?▼

Subfinder works without API keys using free sources like certificate transparency logs, but results improve significantly with keys for Shodan, Censys, VirusTotal, SecurityTrails, and Chaos. Keys are configured in $HOME/.config/subfinder/provider-config.yaml.

Why does Subfinder return few or no subdomains?▼

Sparse results usually mean missing API keys, rate limiting from sources, or a target with minimal passive DNS footprint. Add provider API keys, lower the rate limit with -rate-limit, and try -recursive for deeper enumeration.

Related Skills

Explore More Software Engineering Skills→
marcboggsmarcboggs

autopilot

Runs an autonomous bug bounty hunt loop with scope checks, recon, validation, and reporting checkpoints.

Community
Advanced
xijunwwxijunww
1

known-product-exploit

Automate identification, exploitation, and post-exploitation of known product vulnerabilities with Nuclei.

Community
Advanced
woohyun212woohyun212
21

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

Community
Advanced
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced