skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

subdomain-enumeration

Automate subdomain discovery via certificate logs, APIs, and HTTP probing.

3|1|Updated Jul 2, 2026
Search Tags:#security#discovery#dns#enumeration#recon#subdomain
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill subdomain-enumeration-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subdomain-enumeration
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/subdomain-enumeration
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill subdomain-enumeration-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill solves the challenge of incomplete asset discovery by automating the identification of hidden subdomains, staging environments, and forgotten infrastructure that often serve as the weakest links in a target's security posture.

Core Features & Use Cases

  • Passive Discovery: Aggregates data from certificate transparency logs and public API sources to find subdomains without alerting the target.
  • Live Validation: Probes discovered subdomains to identify active HTTP services, status codes, and technology stacks.
  • Takeover Detection: Automatically flags dangling CNAME records that could potentially be claimed by an attacker.

Quick Start

Use the subdomain-enumeration skill to perform a full passive and active discovery scan on the domain example.com.

Frequently Asked Questions about subdomain-enumeration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden subdomains using certificate transparency logs?▼

Subdomain discovery aggregates certificate transparency logs and passive API sources to identify hidden subdomains without alerting the target. It automates collection from public databases to map internal, staging, and production web assets.

What is the best way to automate subdomain discovery for offensive security reconnaissance?▼

The best way to automate subdomain discovery for reconnaissance is combining passive API aggregation with active HTTP probing. This approach validates discovered hosts to identify active services, status codes, and running technology stacks.

How do I validate active HTTP services after finding subdomains?▼

You validate active HTTP services by probing discovered subdomains with live network requests. This process identifies responsive web assets, checks status codes, and fingerprints the underlying technology stacks.

Do I need subfinder and httpx installed to map target attack surfaces via DNS?▼

Yes, you need subfinder and httpx installed, along with curl and dig. These tools perform the network resolution, passive data aggregation, and live HTTP probing required to map target attack surfaces.

Can I detect potential subdomain takeover vulnerabilities during DNS enumeration?▼

Yes, you can detect potential subdomain takeover vulnerabilities during DNS enumeration. The process automatically flags dangling CNAME records that could be claimed by an attacker to hijack forgotten infrastructure.

Why does passive subdomain enumeration fail to find all staging environments?▼

Passive subdomain enumeration may miss staging environments not indexed in certificate transparency logs or public APIs. Active HTTP probing is required to discover and validate these unindexed internal web assets.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

subdomain-enumeration

Discover registered subdomains via certificate transparency logs and public APIs.

Community
Advanced
cybersecwomancybersecwoman
5

web2-recon

Automate web2 asset, subdomain, and endpoint discovery for security assessments.

Community
Advanced
crazyMarkycrazyMarky
277

recon-port-scan

Scan TCP and UDP ports and identify services with nmap, masscan, or rustscan.

Community
Intermediate
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced