skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

subdomain-enumeration

Enumerate subdomains and identify live hosts and takeover candidates.

846|152|Updated Mar 13, 2026
Search Tags:#reconnaissance#dns#subdomain-enumeration#subdomains#certificate-transparency#subdomain-takeover#http-probing
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill subdomain-enumeration
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-enumeration
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/reconnaissance/subdomain-enumeration
Command: npx skills add https://github.com/xalgord/xalgorix --skill subdomain-enumeration

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Aggregates and validates subdomains from multiple passive and active sources to produce a deduplicated inventory of live hosts and highlight potential takeover risks, eliminating manual merging and probing.

Core Features & Use Cases

  • Multi-source aggregation: Combine certificate transparency, DNS aggregators, archives, and API sources to maximize coverage.
  • Active resolution & probing: Perform DNS brute-force, resolve candidates, and probe HTTP endpoints to identify live hosts and technology stacks.
  • Subdomain takeover detection: Check CNAMEs and use tooling to flag dangling records and takeover candidates.
  • Use Case: Perform reconnaissance for bug bounty programs or internal pentesting to enumerate attack surface and prioritize exploitable hosts.

Quick Start

Run the subdomain-enumeration skill against example.com to collect passive sources, run DNS brute-force, resolve and probe hosts, and output a deduplicated list of live subdomains with takeover flags.

Frequently Asked Questions about subdomain-enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains and identify live hosts for a target domain?▼

Subdomain enumeration aggregates passive certificate transparency sources and active DNS brute-force, then resolves candidates and probes HTTP endpoints to produce a deduplicated inventory of live hosts. You get validated targets without manually merging lists or probing each entry.

What is subdomain takeover detection and how does it check for vulnerable CNAMEs?▼

Subdomain takeover detection checks CNAME records for dangling DNS entries pointing to unclaimed external services. It flags takeover candidates during the resolution phase by identifying CNAMEs that fail to resolve properly, highlighting exploitable hosts for bug bounty and pentesting workflows.

Can I use passive certificate transparency logs for web reconnaissance?▼

Yes, certificate transparency logs and DNS aggregators provide passive subdomain discovery without sending direct traffic to the target. These sources are combined with archives and API data to maximize coverage before active resolution and HTTP probing begin.

What's the best way to find subdomains for bug bounty attack surface mapping?▼

The best approach combines multi-source passive aggregation with active DNS brute-force and HTTP probing to deduplicate and validate results. This eliminates manual merging while highlighting takeover risks and identifying live hosts with their technology stacks.

Does wildcard subdomain sweeping work with DNS brute-force resolution?▼

Wildcard subdomain sweeps are supported alongside DNS brute-force and resolution. The skill combines active brute-force with passive certificate transparency and aggregator sources, resolving all candidates and probing HTTP endpoints to identify live hosts across the target domain.

Related Skills

Explore More Software Engineering Skills→
AstorYHAstorYH
15

dns-record-lookup

Query a DNS server to retrieve IPv4 A records for a domain name.

Community
Basic
uphiagouphiago
1.1k

subdomain-takeover-hunt

Detect subdomain takeover risks from dangling CNAME records.

Community
Advanced
chainreactorschainreactors
235

spray

Probe HTTP services and fingerprint web technologies on target hosts.

Official
Intermediate
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced