skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

subdomain-deep

Enumerate subdomains via DNS brute-force, OSINT, and web crawling.

1.6k|234|Updated Dec 7, 2019
Search Tags:#crawler#osint#asset-discovery#subdomain#dns-enumeration#wildcard-dns
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill subdomain-deep
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-deep
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/recon/subdomain-deep
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill subdomain-deep

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Deeply discovers and consolidates subdomains when single-source DNS enumeration is insufficient, improving asset coverage and reducing missed exposures caused by CDNs, wildcard DNS, or removed DNS records.

Core Features & Use Cases

  • Multi-source Enumeration: Combine DNS brute-force, passive OSINT aggregation, and web crawling to maximize coverage.
  • Wildcard and CDN Handling: Detect and filter wildcard DNS results using HTTP response comparison and identify CDN CNAMEs and potential dangling S3 buckets.
  • Result Deduplication & Prioritization: Merge, deduplicate, and categorize findings into web, API, admin, dev, and internal systems for prioritized follow-up.
  • Use Case: When DNS-only scans return limited results for a corporate domain, run this workflow to discover hidden staging, admin, and API subdomains that could expose vulnerabilities.

Quick Start

Run a deep subdomain enumeration for example.com by combining passive OSINT sources, DNS brute-force, and a site crawler, then filter wildcard results and return a deduplicated categorized list.

Frequently Asked Questions about subdomain-deep

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden subdomains when DNS enumeration returns limited results?▼

Subdomain discovery combines DNS brute-force, passive OSINT aggregation, and web crawling to maximize coverage. It deduplicates and categorizes findings into web, API, admin, dev, and internal systems.

How do I filter wildcard DNS results during subdomain brute-force?▼

Filter wildcard DNS results during subdomain brute-force by comparing HTTP responses to identify and exclude wildcard resolutions, ensuring accurate asset discovery.

What is the best way to discover staging and admin subdomains for a corporate domain?▼

The best way to discover staging and admin subdomains is running multi-source enumeration that merges DNS brute-force, OSINT lookups, and site crawling, then categorizes the deduplicated asset lists.

Does subdomain discovery work for targets using CDNs or multi-cloud deployments?▼

Yes, subdomain discovery works for CDN and multi-cloud targets by identifying CDN CNAMEs, detecting potential dangling S3 buckets, and applying wildcard filtering to handle complex DNS configurations.

Why are my passive OSINT lookups missing subdomains with removed DNS records?▼

Passive OSINT lookups miss subdomains with removed DNS records because they rely on historical data. Adding active DNS brute-force and web crawling for embedded domains maximizes discovery.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

dns-recon

Map DNS records and detect misconfigurations using dig, host, and nslookup.

Community
Advanced
gongzeqgongzeq

httpx-probe

Probe hosts with httpx to capture HTTP status, title, server, and TLS fingerprint.

Community
Intermediate
rafaelcallejarafaelcalleja
2

ffuf-web-fuzzing

Fuzz web resources to discover hidden directories, files, and subdomains.

Community
Advanced
AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced