subdomain-enum

What this skill does

Enumerates subdomains of a target domain using subfinder and amass. Collects results from multiple sources (Certificate Transparency, DNS brute-force, passive databases, etc.), merges and deduplicates them, then validates live hosts using httpx.

When to use

During the initial reconnaissance phase of a penetration test to map the attack surface
When defining the scope for a bug bounty target
When periodically auditing an organization's exposed subdomain inventory

Prerequisites

Go 1.21 or later installed

Install subfinder:

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Install amass (optional):

go install -v github.com/owasp-amass/amass/v4/...@master

Install httpx (for live host validation):

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

Environment variable SECSKILL_TARGET_DOMAIN: target domain (e.g. example.com)
Environment variable SECSKILL_OUTPUT_DIR: directory for saving results (default: ./output)

Inputs

Variable	Required	Description
`SECSKILL_TARGET_DOMAIN`	required	Root domain to enumerate
`SECSKILL_OUTPUT_DIR`	optional	Path to save result files (default: `./output`)
`SECSKILL_USE_AMASS`	optional	Set to `true` to also run amass (default: `false`)

Workflow

Step 1: Prepare environment

export TARGET="${SECSKILL_TARGET_DOMAIN:?Set the SECSKILL_TARGET_DOMAIN environment variable}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
mkdir -p "$OUTDIR"
echo "[*] Target domain: $TARGET"
echo "[*] Output directory: $OUTDIR"

Step 2: Run subfinder

echo "[*] Running subfinder..."
subfinder -d "$TARGET" \
  -silent \
  -o "$OUTDIR/subfinder_${TARGET}.txt"
echo "[+] subfinder complete: $(wc -l < "$OUTDIR/subfinder_${TARGET}.txt") results"

Step 3: Run amass (optional)

if [ "${SECSKILL_USE_AMASS:-false}" = "true" ]; then
  echo "[*] Running amass (this may take a while)..."
  amass enum -passive -d "$TARGET" \
    -o "$OUTDIR/amass_${TARGET}.txt"
  echo "[+] amass complete: $(wc -l < "$OUTDIR/amass_${TARGET}.txt") results"
else
  echo "[*] Skipping amass (enable with SECSKILL_USE_AMASS=true)"
fi

Step 4: Merge results and deduplicate

echo "[*] Merging results..."
cat "$OUTDIR"/subfinder_*.txt "$OUTDIR"/amass_*.txt 2>/dev/null \
  | sort -u \
  > "$OUTDIR/all_subdomains_${TARGET}.txt"
TOTAL=$(wc -l < "$OUTDIR/all_subdomains_${TARGET}.txt")
echo "[+] Total subdomains after deduplication: $TOTAL"

Step 5: Validate live hosts with httpx

echo "[*] Validating live hosts..."
httpx -l "$OUTDIR/all_subdomains_${TARGET}.txt" \
  -silent \
  -status-code \
  -title \
  -tech-detect \
  -o "$OUTDIR/live_subdomains_${TARGET}.txt"
LIVE=$(wc -l < "$OUTDIR/live_subdomains_${TARGET}.txt")
echo "[+] Live hosts: $LIVE"
echo "[+] Results saved to: $OUTDIR/live_subdomains_${TARGET}.txt"

Step 6: Print summary

echo ""
echo "===== Subdomain Enumeration Summary ====="
echo "Target domain : $TARGET"
echo "Total found   : $TOTAL"
echo "Live hosts    : $LIVE"
echo "Output files  : $OUTDIR/"
echo "========================================="

Done when

all_subdomains_${TARGET}.txt is created and contains at least one entry
live_subdomains_${TARGET}.txt is created
Each step exits with code 0

Failure modes

Symptom	Cause	Resolution
`subfinder: command not found`	Not installed	Check Go PATH and reinstall
0 results	Invalid domain or network blocked	Verify domain, test DNS connectivity
httpx timeout	Network latency	Adjust with `-timeout` flag
amass taking too long	Active enumeration mode	Use `-passive` flag or disable amass

Notes

Only use against domains for which you have prior written authorization.
Adding API keys for subfinder in ~/.config/subfinder/provider-config.yaml yields more results (Shodan, Censys, VirusTotal, etc.).
amass can run for a long time; setting a timeout (-timeout 30) is recommended.
Result files can be used as input for the port-scan and nuclei-scan skills.