recon-subdomain

Subdomain discovery for a pentest uses passive intelligence sources like certificate transparency logs and web archives, followed by gated active DNS resolution. This approach maps an organization's external attack surface while strictly enforcing authorization boundaries and scope validation.

Subdomain takeover detection involves analyzing CNAME records against known vulnerable cloud service patterns. This skill identifies dangling DNS entries pointing to unclaimed third-party resources, exposing potential external attack surface risks during authorized security assessments.

Passive subdomain enumeration collects hostnames from certificate transparency logs, DNS databases, and web archives. This reconnaissance technique maps target infrastructure using third-party data sources, ensuring zero direct network interaction with the assessed domain.

Active DNS resolution and wildcard detection are gated behind strict authorization and scope verification checks. This ensures active network interactions like DNS queries and rate-limited scanning occur only against explicitly permitted target domains.

A scope file is required to validate target boundaries before initiating gated active DNS resolution. Strict adherence to authorization policies and rate-limiting rules ensures all subdomain discovery and attack surface mapping remains within permitted parameters.

Subdomain enumeration requires authorization and rate-limiting to prevent unauthorized scanning and potential service disruption. Gated active DNS resolution verifies scope compliance before sending traffic, ensuring reconnaissance activities remain ethical and legally bounded.