What problem does it solve?
This Skill solves the critical gap of missing hidden subdomains (including staging environments, admin panels, internal APIs, and legacy assets) that are often softer, less secured targets than the main production site, which are essential for a complete reconnaissance workflow but rarely discoverable via direct scanning of the primary domain.
Core Features & Use Cases
- Passive Subdomain Discovery: Aggregates results from crt.sh certificate transparency logs and subfinder's passive API sources to find subdomains without sending direct traffic to the target.
- Live Host Probing & Categorization: Resolves DNS records, probes for active HTTP/HTTPS services, and automatically categorizes subdomains into high-value groups like staging, admin, API, and cloud assets.
- Use Case: When performing a penetration test on a target with a heavily hardened production website, use this Skill to uncover unlisted staging subdomains with default credentials or unpatched WordPress installs that serve as low-effort entry points.
Quick Start
Use the subdomain-enumeration skill to map all subdomains for the target domain example.com, probe for live hosts, and flag high-value targets like staging environments and admin panels for further testing.
