subdomain-enum

Name: subdomain-enum
Availability: InStock
Author: zebbern

Enumerate subdomains with Subfinder, Amass, and Httpx pipelines.

5|3|Updated Apr 10, 2026

Search Tags:#reconnaissance #dns #enumeration #httpx #subdomain #subfinder #amass

Ready to run

npx skills add https://github.com/zebbern/termstack --skill subdomain-enum-zebbern

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: subdomain-enum
Source: https://github.com/zebbern/termstack/tree/main/.github/skills/subdomain-enum
Command: npx skills add https://github.com/zebbern/termstack --skill subdomain-enum-zebbern

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enumerate subdomains for a target domain using passive and active reconnaissance techniques to map the attack surface and identify exposure.

Core Features & Use Cases

Fast passive enumeration with subfinder to discover available subdomains.
Deeper discovery with Amass to expand scope beyond initial roots.
Live validation with Httpx to filter to reachable hosts and collect basic tech data for prioritization.
Use Case: When starting a new engagement, compile a comprehensive subdomain list for targeted testing and vulnerability assessment.

Quick Start

Run a fast passive enumeration with subfinder for your target domain, then validate live subdomains with httpx.

Frequently Asked Questions about subdomain-enum

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate subdomains for a target domain?▼

Subdomain enumeration is performed by applying passive and active reconnaissance techniques against the target domain to discover its attack surface, verify live hosts, and compile a comprehensive subdomain list for vulnerability assessment.

What's the best way to find live subdomains during reconnaissance?▼

Finding live subdomains involves running passive enumeration with subfinder or Amass to gather names, then validating the discovered hosts with httpx to filter reachable targets and collect basic tech data for prioritization.

Does subfinder vs Amass matter for subdomain discovery?▼

Subfinder provides fast passive enumeration to quickly discover available subdomains, while Amass offers deeper discovery to expand scope beyond initial roots, making them complementary stages in the reconnaissance pipeline.

Can I combine and filter subdomain enumeration results automatically?▼

Combining and filtering enumeration results is supported through built-in pipelines that consolidate subfinder and Amass outputs, then validate the assembled list with httpx to isolate live hosts for targeted testing.

When do I need subdomain enumeration for vulnerability assessment?▼

Subdomain enumeration is needed when starting a new engagement to map the attack surface and identify exposure, providing a comprehensive target list for targeted testing and vulnerability assessment across the domain.