skills.rest
baljinnyamday
baljinnyamdayCOMMUNITY
Explore all skills by this author →
GitHub

performing-subdomain-enumeration-with-subfinder

Enumerate subdomains of target domains using Subfinder passive reconnaissance sources.

Updated May 27, 2026
Search Tags:#penetration testing#reconnaissance#subdomain enumeration#httpx#attack surface#subfinder#passive dns
One-click install
npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill performing-subdomain-enumeration-with-subfinder-baljinnyamday
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-subdomain-enumeration-with-subfinder
Source: https://github.com/baljinnyamday/autonomous-red-team-agent/tree/main/harness/src/agent_redteam/skill_library/performing-subdomain-enumeration-with-subfinder
Command: npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill performing-subdomain-enumeration-with-subfinder-baljinnyamday

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams need a complete map of an organization's external attack surface, but manually discovering subdomains across dozens of passive data sources is slow and incomplete. This Skill automates subdomain enumeration with ProjectDiscovery's Subfinder so you can build a thorough asset inventory before scanning or testing. ## Core Features & Use Cases - Passive Subdomain Enumeration: Query certificate transparency logs, passive DNS databases, and APIs like Shodan, Censys, VirusTotal, and SecurityTrails without touching target DNS servers. - Source Control and Rate Limiting: Select or exclude specific sources, run recursive enumeration, and throttle requests to avoid API throttling. - Pipeline Integration: Pipe results into httpx for live-host validation, dnsx for resolution, nuclei for vulnerability scanning, or combine with Amass for broader coverage. - Use Case: During a bug bounty engagement, enumerate all subdomains of the in-scope domain, validate which hosts are live with httpx, and feed the results into nuclei to find vulnerabilities on forgotten staging or development assets. ## Quick Start Use Subfinder to enumerate all subdomains of example.com, validate the live hosts with httpx, and produce a report of discovered assets.

Frequently Asked Questions about performing-subdomain-enumeration-with-subfinder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains with Subfinder?▼

Run subfinder with the -d flag followed by the target domain, for example subfinder -d example.com -o subdomains.txt. Use -dL to pass a file of domains, -all to query every passive source, and -silent to pipe clean output into other tools.

How to find live subdomains after enumeration?▼

Pipe Subfinder output into httpx to validate which subdomains respond over HTTP, for example subfinder -d example.com -silent | httpx -silent -status-code. You can also use dnsx to resolve IP addresses for discovered names.

Subfinder vs Amass for subdomain enumeration?▼

Subfinder focuses on fast passive enumeration from many online sources, while Amass offers both passive and active modes with deeper DNS analysis. The Skill recommends running both and merging results with sort -u for broader coverage.

Does Subfinder require API keys to work?▼

Subfinder works without keys using free sources like crt.sh, but configuring API keys for Shodan, Censys, VirusTotal, SecurityTrails, and Chaos in $HOME/.config/subfinder/provider-config.yaml significantly increases result coverage.

Why is Subfinder returning few or no results?▼

Few results usually mean missing or invalid API keys, rate limiting from sources, or a target with minimal passive DNS presence. Add provider keys, lower the rate limit with -rate-limit, and try -all plus -recursive for deeper enumeration.

Related Skills

Explore More Software Engineering Skills→
kaminocorpkaminocorp
1

Scope Assessment

Verifies a target repository is in-scope for its bug bounty program before analysis.

Official
Intermediate
woohyun212woohyun212
21

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

Community
Advanced
xalgordxalgord
954

performing-dns-enumeration-and-zone-transfer

Enumerates DNS records, attempts zone transfers, and brute-forces subdomains during authorized reconnaissance.

Community
Intermediate
featurectrlfeaturectrl

next-upgrade

Upgrade Next.js projects by applying official codemods and updating dependencies.

Official
Advanced