subfinder_enum

Passive subdomain enumeration identifies subdomains for a target domain without active scanning. It queries configured sources to return structured data including subdomain names, source details, IP addresses, severity, and confidence levels.

Yes, you need subfinder installed locally to execute passive subdomain enumeration. The Skill acts as a wrapper that queries the subfinder tool and structures the returned subdomain data into entities for security research.

Yes, subdomain enumeration supports optional source filtering alongside an all-sources mode. This allows you to target specific reconnaissance data sources or aggregate findings from all available sources to map a domain's attack surface.

Passive subdomain enumeration is the best way to map external exposure safely. It aggregates multiple findings per subdomain into a single structured entity, capturing associated sources and IP addresses for comprehensive asset discovery.

Discovered subdomains are returned as structured JSON payloads containing fields like subdomain, domain, sources, ip_addresses, severity, and confidence, which are compatible with Knowledge Graph entities for risk assessment.

You should avoid passive enumeration when you need guaranteed real-time results or exhaustive coverage of internally hosted services, because it relies on historical third-party source data rather than actively querying the target infrastructure.