performing-subdomain-enumeration-with-subfinder

Enumerate target domain subdomains with Subfinder and output JSON/MD reports.

2|Updated Apr 14, 2026

Search Tags:#reconnaissance #dns #pentesting #osint #bug-bounty #subdomain-enumeration #subfinder

Ready to run

npx skills add https://github.com/Acczdy/MoZiSec --skill performing-subdomain-enumeration-with-subfinder

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: performing-subdomain-enumeration-with-subfinder
Source: https://github.com/Acczdy/MoZiSec/tree/main/web-security/.claude/skills/performing-subdomain-enumeration-with-subfinder
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill performing-subdomain-enumeration-with-subfinder

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill enables security analysts to quickly surface all subdomains for a target domain using Subfinder in passive reconnaissance, helping map the external attack surface and identify exposure.

Core Features & Use Cases

Passive subdomain discovery across target domains using Subfinder with all sources.
DNS resolution and validation of discovered subdomains to identify live assets.
Takeover risk awareness by flagging subdomains with CNAMEs pointing to cloud services.
Use case: In bug bounty programs, map out assets to prioritize hunting for vulnerabilities.

Quick Start

Run this skill against a target domain to enumerate subdomains using Subfinder and review the resulting report in the output directory.

Frequently Asked Questions about performing-subdomain-enumeration-with-subfinder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate subdomains passively for a target domain?▼

Passive subdomain enumeration uses Subfinder with all sources enabled to map the external attack surface of a target domain. It collects subdomain data from third-party sources without sending direct queries to the target's authoritative DNS servers.

How do I validate live subdomains after an initial OSINT reconnaissance scan?▼

You can validate discovered subdomains by enabling optional DNS resolution with dnsx. This identifies live assets by verifying which subdomains from the enumeration output actually resolve to valid IP addresses, helping prioritize targets for pentesting or bug bounty hunting.

Can I detect subdomain takeover risks during DNS reconnaissance?▼

Yes, subdomain takeover risk awareness is included by flagging subdomains with CNAMEs pointing to cloud services. Validating these dangling DNS records during reconnaissance helps identify exposed assets vulnerable to takeover before active testing begins.

What is the best way to output subdomain enumeration results for bug bounty programs?▼

The best way to output subdomain enumeration results is to generate structured JSON and Markdown reports. These formats allow security analysts to map assets, prioritize hunting for vulnerabilities, and document subdomain coverage across target domains.

Do I need to install Subfinder and dnsx to map external attack surfaces?▼

Yes, you need Subfinder installed with all sources enabled to perform the passive subdomain discovery. Optional DNS resolution and validation of discovered subdomains require dnsx, ensuring accurate identification of live assets during the reconnaissance phase.