Enumerate subdomains for a target domain using passive OSINT sources.
npx skills add https://github.com/AeonDave/malskill --skill subfinder
Please help me install this Agent Skill. Skill: subfinder Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/recon/subfinder Command: npx skills add https://github.com/AeonDave/malskill --skill subfinder
This Skill automates the discovery of subdomains for a given domain, helping to map out the full attack surface and identify potential hidden hosts without directly interacting with the target.
example.com, this Skill will provide a list of all known subdomains.Use the subfinder skill to find all subdomains for the domain example.com and save them to a file named subs.txt.
High-intent search queries and answers about installing and using this skill.
Passive subdomain enumeration discovers subdomains by querying over 40 public OSINT sources and online DNS databases, mapping the target's digital footprint without directly interacting with the target infrastructure.
Passive subdomain enumeration is the process of collecting subdomain records from public databases rather than sending direct probes to the target. You need it for attack surface analysis to identify hidden hosts and map infrastructure.
Yes, you can use OSINT sources to find hidden hosts and map your attack surface by leveraging over 40 online databases to gather passive DNS records and uncover subdomains that are not easily visible through direct interaction.
To enumerate subdomains for example.com and save the output, run the passive enumeration task against the domain and direct the resulting list of discovered subdomain records to a text file like subs.txt.
Passive DNS enumeration requires the subfinder tool to query public DNS records and online databases, but it does not require active scanning tools since it relies entirely on querying over 40 public OSINT sources.
Active scanning tools miss hidden subdomains because they rely on direct interaction and probing, whereas OSINT methods aggregate historical and current DNS data from over 40 public databases to uncover subdomains passively.
din4eIdentify target-domain OSINT artifacts and assemble a structured reconnaissance plan.
ArianHobson333Identify subdomains, ports, endpoints, APIs, and attack surfaces.
wgpsecProbe URL lists for live HTTP/HTTPS services and collect fingerprints, titles, headers, and TLS metadata.
wgpsecEnumerate subdomains via DNS brute-force, OSINT, and web crawling.