Recon Series: Subdomain Enumeration
Subdomains are the attic doors of web estates—staging, old marketing campaigns, admin tools. Enumeration finds them; scope tells you which you may touch.
Volume isn't success. Actionable hosts tied to the app are.
Subdomain enumeration teaches patience with false positives—CNAME chains to dead SaaS trials look dramatic in tools but need calm confirmation before report language gets strong.
Passive first
Certificate transparency, DNS aggregators, search engines, and historical data when available. Passive keeps noise down and SOC happy.
Compare results to client-provided inventories.
Active when allowed
Brute force with sane wordlists and resolvers that won't melt. Permutation tools for dev patterns (`dev`, `uat`, `api-` ).
Deduplicate and httpx probe survivors
Flag takeovers only after DNS ownership checks
Respect OOS wildcards explicitly listed
After enumeration
Cluster by technology and freshness. Feed priorities into manual walking and nuclei with restraint.
Found a host doesn't mean test a host—scope wins.
Keep subdomain lists confidential; they're recon output, not trophies.
Teach clients that new subdomains will appear after your test—continuous monitoring beats one-time enum snapshots.
Small habits compound—what feels like overhead early becomes speed when deadlines hit.
Share takeover candidates with defensive contacts early—some fixes are DNS tickets, not code.
Resolver hygiene
Use resolvers that won't rate-limit you into false negatives—and won't get your IP banned from passive APIs.
Track which subdomains are CNAME-only dead ends vs live services to prioritize walking.
Handoff to content discovery
Tag subdomains by age using CT timestamps when available—fresh hosts get first manual look.
Share subdomain spreadsheets with client asset teams; they merge into CMDB faster than PDFs.
Stop brute force when passive sources plateau—diminishing returns smell like noise.
Worth reading next
Tools & Techniques: Amass for Asset Discovery
Subdomain Takeovers Explained for Testers and Defenders
Scope Discovery for Web Pentests: WHOIS, ASN, and Certificates
Comments