agentleFS
Sign inStart free
sunilgentyalasunilgentyala/OmniRed/skills/recon/subdomain-enum/SKILL.md

subdomain-enum

Skill5 starsChanged 5 months agoApache-2.0View on GitHub

Subdomain enumeration expert methodology combining passive, active, and permutation techniques. Includes subdomain takeover detection and live host filtering.

  • Reads credentials

4 other projects use a version of this.

Adopted by

Most recently taken up by

The file

Create a free account to mount
Files
SKILL.md

Subdomain Enumeration

Passive Enumeration (no direct target contact)

# Certificate Transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Subfinder — multi-source passive
subfinder -d target.com -all -o passive.txt

# Amass passive
amass enum -passive -d target.com -o amass-passive.txt

# OSINT sources
assetfinder --subs-only target.com
findomain -t target.com

# GitHub search
curl "https://api.github.com/search/code?q=target.com&type=code" \
  -H "Authorization: token GITHUB_TOKEN" | jq '.items[].html_url'

Active Enumeration (DNS queries to target)

# DNS brute force with PureDNS (fast, handles wildcard)
puredns bruteforce /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt \
  target.com -r resolvers.txt -o active.txt

# Gobuster DNS
gobuster dns -d target.com \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
  -t 50 -o gobuster.txt

Permutation (discover missed subdomains)

# Gotator — permutation from discovered subdomains
gotator -sub passive.txt -perm /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt \
  -depth 1 -numbers 3 > permutations.txt
puredns resolve permutations.txt -r resolvers.txt -o resolved-permutations.txt

Live Host Filtering

# Combine all results
cat passive.txt active.txt resolved-permutations.txt | sort -u > all-subdomains.txt

# Resolve and check HTTP
httpx -l all-subdomains.txt -status-code -title -tech-detect -o live-hosts.txt

# Screenshot all live hosts
gowitness file -f live-hosts.txt

Subdomain Takeover Detection

# Nuclei subdomain takeover templates
nuclei -l live-hosts.txt -t ~/nuclei-templates/takeovers/ -o takeovers.txt

# Manual: check CNAME records pointing to unclaimed services
# (AWS S3, Heroku, GitHub Pages, Fastly, Azure)
for sub in $(cat live-hosts.txt); do
  cname=$(dig CNAME $sub +short)
  if [ -n "$cname" ]; then echo "$sub → $cname"; fi
done

Tools

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free