subdomain-enumeration

Name: subdomain-enumeration
Availability: InStock
Author: entrovyx

Automate subdomain discovery via certificate logs, APIs, and HTTP probing.

3|1|Updated Jul 2, 2026

Search Tags:#security #discovery #dns #enumeration #recon #subdomain

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill subdomain-enumeration-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: subdomain-enumeration
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/subdomain-enumeration
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill subdomain-enumeration-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill solves the challenge of incomplete asset discovery by automating the identification of hidden subdomains, staging environments, and forgotten infrastructure that often serve as the weakest links in a target's security posture.

Core Features & Use Cases

Passive Discovery: Aggregates data from certificate transparency logs and public API sources to find subdomains without alerting the target.
Live Validation: Probes discovered subdomains to identify active HTTP services, status codes, and technology stacks.
Takeover Detection: Automatically flags dangling CNAME records that could potentially be claimed by an attacker.

Quick Start

Use the subdomain-enumeration skill to perform a full passive and active discovery scan on the domain example.com.

Frequently Asked Questions about subdomain-enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find hidden subdomains using certificate transparency logs?▼

Subdomain discovery aggregates certificate transparency logs and passive API sources to identify hidden subdomains without alerting the target. It automates collection from public databases to map internal, staging, and production web assets.

What is the best way to automate subdomain discovery for offensive security reconnaissance?▼

The best way to automate subdomain discovery for reconnaissance is combining passive API aggregation with active HTTP probing. This approach validates discovered hosts to identify active services, status codes, and running technology stacks.

How do I validate active HTTP services after finding subdomains?▼

You validate active HTTP services by probing discovered subdomains with live network requests. This process identifies responsive web assets, checks status codes, and fingerprints the underlying technology stacks.

Do I need subfinder and httpx installed to map target attack surfaces via DNS?▼

Yes, you need subfinder and httpx installed, along with curl and dig. These tools perform the network resolution, passive data aggregation, and live HTTP probing required to map target attack surfaces.

Can I detect potential subdomain takeover vulnerabilities during DNS enumeration?▼

Yes, you can detect potential subdomain takeover vulnerabilities during DNS enumeration. The process automatically flags dangling CNAME records that could be claimed by an attacker to hijack forgotten infrastructure.

Why does passive subdomain enumeration fail to find all staging environments?▼

Passive subdomain enumeration may miss staging environments not indexed in certificate transparency logs or public APIs. Active HTTP probing is required to discover and validate these unindexed internal web assets.