Subdomain Enumeration

Maximum coverage. Multiple sources. Continuously updated.

When to invoke

Trigger phrases:

• "enumerate subdomains for X"
• "subfinder X"
• "find subdomains of target.com"
• "run full subdomain recon"

Pre-flight checklist

• Scope confirmed: *.target.com is in-scope (see [[scope-analysis]])
• OOS list ready (to filter results)
• API keys configured (see below)
• Output dir created: mkdir -p loot/<target>/subs/