subdomain-enumeration

Passive subdomain enumeration discovers web-facing infrastructure by querying certificate transparency logs, search engine dorks, and common DNS records without active brute-forcing. It aggregates publicly available data to identify hostnames.

Certificate transparency log search queries databases like crt.sh for wildcard SSL certificates issued for a domain. It parses the certificate records to extract and deduplicate unique subdomains that have been issued TLS certificates.

Yes, search engine dorking uses curated search queries to surface indexed subdomains for web security testing. Results are merged with certificate transparency findings and validated through DNS resolution to ensure active targets.

Passive DNS enrichment is optional and requires third-party API keys if available. The core enumeration workflow relies on certificate transparency logs, search engine dorks, and common subdomain validation without needing external API access.

Passive recon gathers subdomains from existing public records like certificate transparency logs and search engines, whereas active brute-forcing sends DNS requests for a large wordlist. Passive methods are stealthier for pre-engagement asset discovery.

Discovered subdomains are validated via DNS resolution to confirm they point to active infrastructure. The enumeration process deduplicates merged sources and outputs structured JSON containing evidence and detected naming patterns.