subdomain-enum

What this skill does

Enumerates subdomains of a target domain using subfinder and amass. Collects results from multiple sources (Certificate Transparency, DNS brute-force, passive databases, etc.), merges and deduplicates them, then validates live hosts using httpx.

When to use

• During the initial reconnaissance phase of a penetration test to map the attack surface
• When defining the scope for a bug bounty target
• When periodically auditing an organization's exposed subdomain inventory

Prerequisites

• Go 1.21 or later installed
• Install subfinder:

  go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
  

• Install amass (optional):

  go install -v github.com/owasp-amass/amass/v4/...@master
  

• Install httpx (for live host validation):

  go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
  

• Environment variable SECSKILL_TARGET_DOMAIN: target domain (e.g. example.com)
• Environment variable SECSKILL_OUTPUT_DIR: directory for saving results (default: ./output)

Inputs

Variable	Required	Description
SECSKILL_TARGET_DOMAIN	required	Root domain to enumerate
SECSKILL_OUTPUT_DIR	optional	Path to save result files (default: ./output)
SECSKILL_USE_AMASS	optional	Set to true to also run amass (default: false)

Workflow

Step 1: Prepare environment

export TARGET="${SECSKILL_TARGET_DOMAIN:?Set the SECSKILL_TARGET_DOMAIN environment variable}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
mkdir -p "$OUTDIR"
echo "[*] Target domain: $TARGET"
echo "[*] Output directory: $OUTDIR"

Step 2: Run subfinder

echo "[*] Running subfinder..."
subfinder -d "$TARGET" \
  -silent \
  -o "$OUTDIR/subfinder_${TARGET}.txt"
echo "[+] subfinder complete: $(wc -l < "$OUTDIR/subfinder_${TARGET}.txt") results"

Step 3: Run amass (optional)

if [ "${SECSKILL_USE_AMASS:-false}" = "true" ]; then
  echo "[*] Running amass (this may take a while)..."
  amass enum -passive -d "$TARGET" \
    -o "$OUTDIR/amass_${TARGET}.txt"
  echo "[+] amass complete: $(wc -l < "$OUTDIR/amass_${TARGET}.txt") results"
else
  echo "[*] Skipping amass (enable with SECSKILL_USE_AMASS=true)"
fi