SubdomainEnum

SubdomainEnum

Subdomain enumeration following Jason Haddix's Bug Hunter's Methodology (TBHM), with intelligent target prioritization.

Philosophy: > "For every subdomain you find, you 2x your chance of hacking the target. > For every apex domain you find, you 4x your chance of hacking the target." > — Jason Haddix

Workflow Routing

| Workflow | Trigger | What It Does | |----------|---------|--------------| | Light | "quick subdomains", "fast enum", "light recon", "find subdomains", DEFAULT | subfinder -all → httpx probe → prioritize | | Full | "full enum", "comprehensive", "all subdomains", "thorough recon", "full recon" | All tools parallel → aggregate → httpx probe → prioritize | | Probe | "probe subdomains", "check live hosts" | httpx against provided list → prioritize |

When executing, announce:

Running the **Light** workflow from **SubdomainEnum**...

---

Light Workflow (Default)

When to use: Quick reconnaissance, time-sensitive, initial target assessment.

Time: 1-5 minutes

Tools: subfinder, httpx, PrioritizeTargets

Steps

1. Create output directory:

mkdir -p recon_{domain}_{timestamp}
cd recon_{domain}_{timestamp}

1. Run subfinder with all sources:

subfinder -d {domain} -all -o subdomains-raw.txt

1. Deduplicate and sort:

sort -u subdomains-raw.txt > subdomains.txt
echo "Found $(wc -l  apex_domains.txt

Phase 1: Passive Collection (Parallel)

Run all passive tools simultaneously for each apex domain:

# Terminal 1: Subfinder
subfinder -d {domain} -all -o subfinder.txt

# Terminal 2: Assetfinder  
assetfinder --subs-only {domain} > assetfinder.txt

# Terminal 3: GitHub Subdomains (requires GITHUB_TOKEN)
github-subdomains -d {domain} -e -o github.txt

# Terminal 4: Amass (passive mode, with timeout)
timeout 30m amass enum -passive -d {domain} -o amass.txt

# Terminal 5: Subbdom (requires API key in ~/.subbdom-cli.yaml)
# Linux binary on VPS - run via SSH or install locally
ssh root@207.244.244.11 "~/tools/subbdom-cli/subbdom-cli -z {domain}" > subbdom.txt

For multiple apex domains:

while read domain; do
  subfinder -d "$domain" -all >> subfinder.txt &
  assetfinder --subs-only "$domain" >> assetfinder.txt &
  github-subdomains -d "$domain" -e >> github.txt &
  timeout 30m amass enum -passive -d "$domain" >> amass.txt &
done /dev/null | \
  sort -u > subdomains.txt

# Generate stats
echo "=== TOOL STATISTICS ==="
echo "Subfinder:   $(wc -l /dev/null || echo 0)"
echo "Assetfinder: $(wc -l /dev/null || echo 0)"
echo "GitHub:      $(wc -l /dev/null || echo 0)"
echo "Amass:       $(wc -l /dev/null || echo 0)"
echo "Subbdom:     $(wc -l /dev/null || echo 0)"
echo "Total unique: $(wc -l  resolved.txt

Phase 4: Permutation/Brute Force (Optional)

For maximum coverage:

# Generate permutations with dnsgen
cat resolved.txt | dnsgen - > permutations.txt

# Resolve permutations
puredns resolve permutations.txt -r resolvers.txt -w permutation-resolved.txt

# Add new findings
cat resolved.txt permutation-resolved.txt | sort -u > all-resolved.txt

Phase 5: HTTP Probing

httpx -l subdomains.txt -silent -status-code -title -tech-detect \
  -json -o probe.json

httpx -l subdomains.txt -silent -o live.txt

Phase 6: Target Prioritization

bun ~/clawd/skills/SubdomainEnum/tools/PrioritizeTargets.ts \
  --input probe.json --output report.md

Output Structure

recon_{domain}_{timestamp}/
├── apex_domains.txt        # All apex domains (if tenant-domains used)
├── subfinder.txt           # Subfinder results
├── assetfinder.txt         # Assetfinder results
├── github.txt              # GitHub results
├── amass.txt               # Amass results
├── subdomains.txt          # Aggregated, deduplicated
├── resolved.txt            # DNS-verified subdomains
├── probe.json              # httpx JSON output
├── live.txt                # Live HTTP/S hosts
├── report.md               # Prioritized target report
└── high-value.txt          # Quick grep of interesting targets

---

Target Prioritization

The PrioritizeTargets engine scores every live host and generates a prioritized report.

Scoring Criteria

CRITICAL (Score 90-100):

• Admin panels, dashboards, consoles
• Authentication servers (SSO, SAML, OAuth)
• Internal tools exposed (Jenkins, Grafana, Kibana, Prometheus)
• Cloud management consoles

HIGH (Score 70-89):

• Development/staging environments
• API endpoints (GraphQL, REST, Swagger, OpenAPI)
• File upload/storage endpoints
• Database interfaces (phpMyAdmin, Adminer)

MEDIUM (Score 50-69):

• Partner/vendor portals
• Mobile backends
• Legacy systems
• Sites with interesting technologies

**LOW (Score > subs.txt | | GitHub search | github-subdomains -d target.com -e >> subs.txt | | Deep enum | amass enum -passive -d target.com >> subs.txt | | Subbdom DB | ssh VPS "~/tools/subbdom-cli/subbdom-cli -z target.com" | | Verify DNS | cat subs.txt \| dnsx -silent > resolved.txt | | Find live | httpx -l resolved.txt -json -o probe.json | | Prioritize | bun tools/PrioritizeTargets.ts --input probe.json --output report.md` |

---

Examples

Example 1: Light enumeration (default)

User: "Find subdomains for target.com"
→ Light workflow
→ subfinder -all → httpx → prioritize
→ "Found 234 subdomains, 156 live.
   🔴 CRITICAL: 3 | 🟠 HIGH: 12 | 🟡 MEDIUM: 45 | ⚪ LOW: 96
   Top: admin.target.com (95), api-dev.target.com (82)"

Example 2: Full enumeration

User: "Do full subdomain enumeration on example.org"
→ Full workflow
→ All tools parallel → aggregate → httpx → prioritize
→ "Found 1,547 unique subdomains. 892 live.
   🔴 CRITICAL: 8 | 🟠 HIGH: 34 | 🟡 MEDIUM: 156 | ⚪ LOW: 694
   Tool breakdown: subfinder 789, assetfinder 456, github 523, amass 1203"

Example 3: Quick recon with report

User: "Quick recon on target.com, prioritize targets"
→ Light workflow (prioritization always included)
→ Outputs report.md with CRITICAL→LOW targets and attack surface notes

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: SecurityTalent
• Source: SecurityTalent/bugskill-ai
• License: MIT
• Homepage: https://securitytalent.net

Install and usage instructions live in the source repository linked above.