⛔ In-depth reference: For the complete parameters of subfinder/ksubdomain/amass, wildcard filtering scripts, and the multi-tool joint workflow, see
references/enumeration-tools.md
Subdomain enumeration from a single source usually covers only 30-50% of actual assets. This methodology combines three independent sources for cross-validation to maximize coverage.
Phase 1: DNS Enumeration
Use subfinder / ksubdomain to perform DNS subdomain enumeration (dictionary brute-forcing + recursive discovery).
Result Analysis：
- Count subdomains resolving to different IP ranges (identify multi-datacenter/multi-cloud deployments)
- Identify CNAME records → CDN/cloud services (CloudFront, Cloudflare, Fastly)
- Identify wildcards: if
random12345.example.comalso resolves, it indicates a wildcard record- When a wildcard exists, results corresponding to the wildcard IP need to be filtered out
Phase 2: OSINT Engine Search
Query the FOFA API via http_request or curl to obtain domain-related assets. OSINT engines can discover assets missed by DNS enumeration (because they are based on actual network scan data, not DNS records).
Discoveries OSINT can supplement：
- Web services using non-standard ports (such as
dev.example.com:8443） - "Ghost" subdomains whose DNS records have been deleted but whose services are still online
- Other domains on the same server discovered through reverse IP lookup
Phase 3: Crawler Discovery
Use katana to crawl the main site and known subdomains, extracting more subdomain references from page content.
Sources crawlers can discover：
- Links in HTML (href/src/action)
- Hardcoded API addresses in JavaScript
- Resource domains referenced in CSS
- Cross-origin request headers (CORS: Access-Control-Allow-Origin)
Phase 4: Result Merging and Classification
After deduplicating and merging the subdomains from the three sources, classify them by purpose:
| Type | Characteristics | Attack Value |
|---|---|---|
| Web Application | 80/443, HTTP response | High — primary attack surface |
| API Service | api./gateway. | High — often has authentication flaws |
| Admin Backend | admin./manage./cms.* | Extremely high — direct administrative privileges |
| Mail System | mail./smtp./mx.* | Medium — phishing and information gathering |
| Development/Testing | dev./test./staging.* | Extremely high — weakest security measures |
| Internal System | vpn./oa./git./jenkins. | Extremely high — should not be publicly reachable |
| CDN/Static | cdn./static./img.* | Low — usually no dynamic content |
Prioritize in-depth probing: Admin Backend > Development/Testing > Internal System > API > Web Application
Wildcard Resolution Handling
- Wildcard DNS detection: after dictionary enumeration, content comparison is needed; HTTP response comparison distinguishes real from fake subdomains
CNAME/CDN Identification
- S3 bucket：
s3.amazonaws.comCNAME pointing - When 404/bucket is undeclared, a bucket with the same name may be registerable for takeover