subdomain-enum

What this skill does

Enumerates subdomains of a target domain using subfinder and amass. Collects results from multiple sources (Certificate Transparency, DNS brute-force, passive databases, etc.), merges and deduplicates them, then validates live hosts using httpx.

When to use

• During the initial reconnaissance phase of a penetration test to map the attack surface
• When defining the scope for a bug bounty target
• When periodically auditing an organization's exposed subdomain inventory

Prerequisites