skills.rest
woohyun212
woohyun212COMMUNITY
Explore all skills by this author →
WebsiteGitHub

subdomain-enum

Enumerate subdomains with subfinder and amass, then validate live hosts using httpx.

21|1|Updated Apr 12, 2026
Search Tags:#httpx#osint#attack-surface#subdomain-enumeration#recon#subfinder#amass
One-click install
npx skills add https://github.com/woohyun212/security-skill --skill subdomain-enum-woohyun212
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-enum
Source: https://github.com/woohyun212/security-skill/tree/main/subdomain-enum
Command: npx skills add https://github.com/woohyun212/security-skill --skill subdomain-enum-woohyun212

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Map and validate an organization's external subdomain inventory to reveal exposed assets and reduce blind spots during reconnaissance. The skill consolidates findings from multiple discovery sources, removes duplicates, and confirms which hosts are live so analysts can prioritize follow-up testing.

Core Features & Use Cases

  • Multi-source aggregation: Collects results from subfinder and optional amass (Certificate Transparency, passive databases, DNS brute-force) and merges them into a single deduplicated list.
  • Live host validation: Uses httpx to check status codes, titles, and technologies to distinguish reachable hosts from stale entries.
  • Use Cases: Building an attack surface inventory during pentests or bug bounty engagements, augmenting asset inventories for security teams, and supplying validated targets to port-scan and vulnerability scan workflows.

Quick Start

Use the subdomain-enum skill to enumerate example.com, validate live hosts, and save deduplicated results to the output directory.

Frequently Asked Questions about subdomain-enum

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains and validate live hosts for attack surface discovery?▼

Subdomain enumeration uses subfinder for passive discovery and httpx to validate live hosts. It consolidates findings from multiple sources, removes duplicates, and confirms reachable web assets to reveal exposed external infrastructure.

What is the best way to build an external asset inventory using subfinder and amass?▼

Building an asset inventory requires aggregating subdomains from subfinder and optional amass, then validating them with httpx. This multi-source approach merges Certificate Transparency and passive DNS data into a single deduplicated list of live targets.

Can I use httpx to check status codes and technologies on discovered subdomains?▼

Yes, httpx validates discovered subdomains by checking HTTP status codes, page titles, and web technologies. This live host validation distinguishes active web applications from stale DNS entries during reconnaissance.

Do I need amass to perform subdomain enumeration, or is subfinder sufficient?▼

Subfinder is the primary tool required for passive discovery, while amass is optional for extended enumeration. Using both improves coverage by adding Certificate Transparency, passive databases, and DNS brute-force results to the consolidated output.

How do I remove duplicate subdomains when aggregating results from multiple recon tools?▼

Deduplication is handled automatically by merging passive results from subfinder and amass into a single list. The skill writes deduplicated outputs to a specified directory, ensuring analysts have a clean dataset for vulnerability scans.

Does subdomain enumeration work for bug bounty engagements and periodic asset inventory checks?▼

Yes, subdomain enumeration is designed for penetration tests, bug bounty engagements, and periodic asset inventory. It maps external attack surfaces by consolidating and validating discovered hosts to reduce blind spots.

Related Skills

Explore More Software Engineering Skills→
twjarviszyra-webtwjarviszyra-web
3

domain-intel

Extract subdomains, DNS records, WHOIS data, and SSL certificate details from domains.

Community
Intermediate
jassicsjassics
6

network-pentest

Automate authorized network penetration testing from host discovery to post-exploitation.

Community
Advanced
BrownFineSecurityBrownFineSecurity
811

nmap

Identify open ports and enumerate network services with Nmap.

Official
Advanced
wgpsecwgpsec
1.6k

subdomain-deep

Enumerate subdomains via DNS brute-force, OSINT, and web crawling.

Official
Intermediate