Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

5|3|Updated Oct 13, 2025

Search Tags:#reconnaissance #DNS #subdomain enumeration #brute force #security automation #attack surface #shadow IT

Ready to run

npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill automated-subdomain-enumeration

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Automated Subdomain Enumeration
Source: https://github.com/macaugh/super-rouge-hunter-skills/tree/main/skills/reconnaissance/automated-subdomain-enum
Command: npx skills add https://github.com/macaugh/super-rouge-hunter-skills --skill automated-subdomain-enumeration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the challenge of discovering all subdomains for a target domain, enabling comprehensive attack surface mapping by combining passive data sources with active DNS enumeration. It helps identify forgotten or misconfigured assets that may present vulnerabilities and exposure.

Core Features & Use Cases

Passive & Active Discovery: Integrates multiple sources to collect subdomains without and with direct target interaction.
Validation & Prioritization: Filters live domains and categorizes findings to guide further assessment.
Use Case: Build a complete inventory of an organization's subdomains (including development, staging, and shadow IT) to plan targeted assessments.

Quick Start

Use the automated_subdomain_enum.sh script with your target domain.

Frequently Asked Questions about Automated Subdomain Enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate subdomain enumeration for a target domain?▼

Automate subdomain enumeration by running the automated_subdomain_enum.sh script against your target domain, combining passive Certificate Transparency logs with active DNS querying and wordlist-based brute forcing to collect subdomains.

What is the difference between passive and active DNS subdomain discovery?▼

Passive subdomain discovery queries Certificate Transparency logs without touching the target, while active DNS enumeration uses direct DNS querying and brute forcing to interact with the target's authoritative servers.

Can I find shadow IT environments using subdomain enumeration?▼

Yes, subdomain enumeration discovers shadow IT by inventorying forgotten or misconfigured assets across development, staging, and production environments within your authorized scope to map the full attack surface.

What's the best way to validate live subdomains after DNS brute forcing?▼

Validate live subdomains by performing DNS and HTTP probing on the collected results, filtering out dead records to categorize and prioritize live domains for further security assessment.

Do I need any dependencies to run subdomain enumeration and DNS probing?▼

No external dependencies are required to run the subdomain enumeration script, as it operates independently to integrate Certificate Transparency logs, DNS querying, and wordlist-based brute forcing.