skills.rest
zebbern
zebbernCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

subdomain-enum

Enumerate subdomains with Subfinder, Amass, and Httpx pipelines.

5|3|Updated Apr 10, 2026
Search Tags:#reconnaissance#dns#enumeration#httpx#subdomain#subfinder#amass
One-click install
npx skills add https://github.com/zebbern/termstack --skill subdomain-enum-zebbern
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-enum
Source: https://github.com/zebbern/termstack/tree/main/.github/skills/subdomain-enum
Command: npx skills add https://github.com/zebbern/termstack --skill subdomain-enum-zebbern

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enumerate subdomains for a target domain using passive and active reconnaissance techniques to map the attack surface and identify exposure.

Core Features & Use Cases

  • Fast passive enumeration with subfinder to discover available subdomains.
  • Deeper discovery with Amass to expand scope beyond initial roots.
  • Live validation with Httpx to filter to reachable hosts and collect basic tech data for prioritization.
  • Use Case: When starting a new engagement, compile a comprehensive subdomain list for targeted testing and vulnerability assessment.

Quick Start

Run a fast passive enumeration with subfinder for your target domain, then validate live subdomains with httpx.

Frequently Asked Questions about subdomain-enum

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains for a target domain?▼

Subdomain enumeration is performed by applying passive and active reconnaissance techniques against the target domain to discover its attack surface, verify live hosts, and compile a comprehensive subdomain list for vulnerability assessment.

What's the best way to find live subdomains during reconnaissance?▼

Finding live subdomains involves running passive enumeration with subfinder or Amass to gather names, then validating the discovered hosts with httpx to filter reachable targets and collect basic tech data for prioritization.

Does subfinder vs Amass matter for subdomain discovery?▼

Subfinder provides fast passive enumeration to quickly discover available subdomains, while Amass offers deeper discovery to expand scope beyond initial roots, making them complementary stages in the reconnaissance pipeline.

Can I combine and filter subdomain enumeration results automatically?▼

Combining and filtering enumeration results is supported through built-in pipelines that consolidate subfinder and Amass outputs, then validate the assembled list with httpx to isolate live hosts for targeted testing.

When do I need subdomain enumeration for vulnerability assessment?▼

Subdomain enumeration is needed when starting a new engagement to map the attack surface and identify exposure, providing a comprehensive target list for targeted testing and vulnerability assessment across the domain.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

subdomain-enum

Enumerate subdomains with subfinder and amass, then validate live hosts using httpx.

Community
Intermediate
Happy-Technologies-LLCHappy-Technologies-LLC
34

vulnerability-deduplication

Merge duplicate vulnerability records across scanners using CVSS prioritization.

Official
Advanced
crazyMarkycrazyMarky
277

recon-port-scan

Scan TCP and UDP ports and identify services with nmap, masscan, or rustscan.

Community
Intermediate
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced