skills.rest
macaugh
macaughCOMMUNITY
Explore all skills by this author →
GitHub

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

5|3|Updated Oct 13, 2025
Search Tags:#reconnaissance#DNS#subdomain enumeration#brute force#security automation#attack surface#shadow IT
One-click install
npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill automated-subdomain-enumeration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Automated Subdomain Enumeration
Source: https://github.com/macaugh/super-rouge-hunter-skills/tree/main/skills/reconnaissance/automated-subdomain-enum
Command: npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill automated-subdomain-enumeration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the challenge of discovering all subdomains for a target domain, enabling comprehensive attack surface mapping by combining passive data sources with active DNS enumeration. It helps identify forgotten or misconfigured assets that may present vulnerabilities and exposure.

Core Features & Use Cases

  • Passive & Active Discovery: Integrates multiple sources to collect subdomains without and with direct target interaction.
  • Validation & Prioritization: Filters live domains and categorizes findings to guide further assessment.
  • Use Case: Build a complete inventory of an organization's subdomains (including development, staging, and shadow IT) to plan targeted assessments.

Quick Start

Use the automated_subdomain_enum.sh script with your target domain.

Frequently Asked Questions about Automated Subdomain Enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration for a target domain?▼

Automate subdomain enumeration by running the automated_subdomain_enum.sh script against your target domain, combining passive Certificate Transparency logs with active DNS querying and wordlist-based brute forcing to collect subdomains.

What is the difference between passive and active DNS subdomain discovery?▼

Passive subdomain discovery queries Certificate Transparency logs without touching the target, while active DNS enumeration uses direct DNS querying and brute forcing to interact with the target's authoritative servers.

Can I find shadow IT environments using subdomain enumeration?▼

Yes, subdomain enumeration discovers shadow IT by inventorying forgotten or misconfigured assets across development, staging, and production environments within your authorized scope to map the full attack surface.

What's the best way to validate live subdomains after DNS brute forcing?▼

Validate live subdomains by performing DNS and HTTP probing on the collected results, filtering out dead records to categorize and prioritize live domains for further security assessment.

Do I need any dependencies to run subdomain enumeration and DNS probing?▼

No external dependencies are required to run the subdomain enumeration script, as it operates independently to integrate Certificate Transparency logs, DNS querying, and wordlist-based brute forcing.

Related Skills

Explore More Software Engineering Skills→
briiirussellbriiirussell
345

recon

Enumerate external attack surface via passive and authorized active recon.

Community
Intermediate
skyasu2skyasu2
2

security-audit-workflow

Automate pre-deployment security audits for Next.js/Supabase CI pipelines.

Community
Advanced
GarrettRoiGarrettRoi

domain-intel

Perform passive domain reconnaissance via Certificate Transparency, SSL, WHOIS, and DNS checks.

Community
Intermediate
riparinoriparino
1

defensive-exposure-management

Discover internet-facing assets and detect exposure risks across cloud and on-prem environments.

Community
Intermediate