Subdomain & live-host enumeration

When it applies

External, in-scope, wildcard programs where surface = subdomains. Do this before hunting; most bugs live on forgotten hosts (staging, dev, legacy, acquisitions).

Why it works

Organizations sprint faster than they inventory. Passive sources (CT logs, DNS aggregators) plus permutation/brute-force surface hosts nobody remembers — and those skip the hardening the flagship app got.