IntermediateOSINT

Subdomain Enumeration: Finding Hidden Attack Surface

Master subdomain enumeration techniques using passive and active methods to discover hidden subdomains and expand attack surface mapping.

#Subdomain Enumeration#OSINT#DNS#Attack Surface#Reconnaissance

Attack Surface Discovery

Subdomain enumeration is a methodology for discovering hidden attack surfaces within a target's domain infrastructure. Organizations host different services on separate subdomains — development servers, staging environments, API endpoints, admin panels — many of which are less monitored and secured than the primary site. Identifying these subdomains maps the full extent of a target's online presence and reveals potential entry points overlooked by defenders.

Main domain: company.com (well-secured, behind WAF)
Hidden: dev-api.company.com (no WAF, default credentials)
Hidden: test.company.com (staging, outdated software)
Hidden: admin.company.com (internal panel, weak auth)

Prerequisites

Before studying subdomain enumeration, you should understand:

**DNS Enumeration** — DNS record types and queries

**OSINT Introduction** — Passive vs active recon

**Linux Commands Explained** — Command line proficiency

**Reconnaissance Workflow** — Overall methodology

Passive Subdomain Enumeration

Certificate Transparency Logs

# Using crt.sh
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Using certspotter
curl -s "https://certspotter.com/api/v0/certs?domain=target.com" | jq -r '.[].dns_names[]' | sort -u

Search Engines

# Google dork
site:target.com -www -mail

DNS Datasets

# SecurityTrails
curl -s "https://api.securitytrails.com/v1/domain/target.com/subdomains"   -H "APIKEY: YOUR_KEY" | jq -r '.subdomains[]' | awk '{print $0".target.com"}'

# AlienVault OTX
curl -s "https://otx.alienvault.com/api/v1/indicators/domain/target.com/passive_dns"   | jq -r '.passive_dns[].hostname' | sort -u

Active Subdomain Enumeration

DNS Brute Forcing

# Using dnsrecon
dnsrecon -d target.com -D /usr/share/wordlists/dns/subdomains-top1million-20000.txt -t brt

# Using gobuster
gobuster dns -d target.com -w /usr/share/wordlists/dns/subdomains-top1million-110000.txt

# Using ffuf for virtual host discovery
ffuf -w subdomains.txt:HOST -u https://target.com -H "Host: HOST.target.com" -fc 400,403,404,301

# Using massdns (fastest)
massdns -r /usr/share/seclists/Discovery/DNS/resolvers.txt -t A -o S -w results.txt subdomains.txt

DNS Zone Transfer

for ns in $(dig target.com NS +short); do
    echo "Trying $ns..."
    dig @$ns target.com AXFR +short 2>/dev/null
done

Web Scraping

# Extract links from main site
curl -s https://target.com | grep -oP 'https?://[a-zA-Z0-9.-]*.target.com' | sort -u

# Check robots.txt and sitemap.xml
curl -s https://target.com/robots.txt
curl -s https://target.com/sitemap.xml | grep -oP 'https?://[^/]+'

Subdomain Takeover Detection

When a subdomain's DNS points to a third-party service that has been deprovisioned, anyone can claim it:

# Check for dangling CNAME records
dig subdomain.target.com CNAME +short

# Automated detection
subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt

# Using Nuclei
nuclei -t nuclei-templates/subdomain-takeover/ -l subdomains.txt

Vulnerable Services

| CNAME Target | Service | Check |

|--------------|---------|-------|

| cloudfront.net | AWS CloudFront | NXDOMAIN |

| s3.amazonaws.com | AWS S3 | NoSuchBucket |

| github.io | GitHub Pages | 404 |

| herokuapp.com | Heroku | No such app |

| azurewebsites.net | Azure | 404 |

| firebaseio.com | Firebase | Not found |

Real-World Examples

Uber Subdomain Takeover (2016): A researcher found multiple Uber subdomains vulnerable to takeover through CloudFront, earning critical bounties.

Samsung (2020): Several Samsung subdomains were taken over by pointing CNAME records to unclaimed AWS S3 buckets.

Common Mistakes

Only using one source: Combining passive and active sources yields the best results.

Not checking for wildcard records: *.target.com causes false positives in brute forcing.

Ignoring subdomain takeovers: Dangling CNAME records are high-severity findings.

Best Practices

**Combine passive and active techniques** for maximum coverage

**Use multiple wordlists** — Different lists find different patterns

**Check for wildcard DNS records** — Verify findings are real

**Leverage certificate transparency logs** — Rich passive source

**Automate enumeration** — Create repeatable scripts

**Always test for takeovers** on discovered subdomains

Related Tools

**dnsrecon** — DNS enumeration and zone transfer

**gobuster** — DNS subdomain brute forcing

**massdns** — High-performance DNS resolution

**subjack** — Subdomain takeover detection

**Sublist3r** — Passive subdomain discovery

**Amass** — Comprehensive attack surface mapping

DNS Enumeration

OSINT Introduction

Amass Guide

Reconnaissance Workflow

Summary

Subdomain enumeration combines passive sources (certificate logs, search engines, DNS datasets) with active techniques (brute forcing, zone transfers, web scraping). Discovering hidden subdomains reveals additional attack surface and potential takeover opportunities.

Knowledge Check

What is the advantage of passive enumeration over active?

How do certificate transparency logs help find subdomains?

What is subdomain takeover and when does it occur?

How does a wildcard DNS record affect brute forcing?

Name three services commonly vulnerable to subdomain takeover.

Frequently Asked Questions

Why is subdomain enumeration important for security?

Organizations often host development servers, staging environments, and admin panels on subdomains with weaker security than the main site. Finding these hidden subdomains expands the attack surface and may reveal vulnerable services.

What are certificate transparency logs?

Certificate Transparency logs (crt.sh, CertSpotter) record every SSL certificate issued. Since certificates include all subdomains, querying these logs passively reveals subdomains without directly touching the target's infrastructure.

How does DNS brute forcing find subdomains?

DNS brute forcing tries thousands of common subdomain names (dev, staging, api, admin) against the target domain. Tools like gobuster and dnsrecon use wordlists to enumerate subdomains by checking if DNS records resolve.

What is subdomain takeover?

Subdomain takeover occurs when a subdomain's DNS points to a third-party service (like GitHub Pages or AWS S3) that has been deprovisioned. An attacker can claim the service and control the subdomain content, potentially serving phishing pages.

Which services are vulnerable to subdomain takeover?

Common vulnerable services include AWS S3 (NoSuchBucket), GitHub Pages (404), Heroku (No such app), Azure (404), and Firebase (Not found). Check dangling CNAME records pointing to these services.

What is the advantage of passive enumeration over active?

Passive enumeration (certificate logs, search engines) doesn't send traffic to the target, making it undetectable. Active techniques (brute forcing, zone transfers) generate DNS queries that may appear in logs but discover subdomains passive sources miss.

How does a wildcard DNS record affect brute forcing?

A wildcard record (*.target.com) resolves every subdomain query to the same IP, causing brute forcing tools to report false positives. Verify findings by checking if random subdomains all resolve to the same address.

What tools are used for subdomain enumeration?

Passive: crt.sh, Sublist3r, SecurityTrails API. Active: gobuster dns, dnsrecon, massdns, ffuf. Comprehensive: Amass (combines 50+ sources). See the [Amass Guide](/learn/amass-guide) for detailed usage.

How do you find subdomains via search engines?

Use Google dorking: `site:target.com -www -mail` excludes the main domain and mail servers, revealing subdomains indexed by Google. Combine with `site:*.target.com` for broader coverage.

What is the difference between DNS and virtual host enumeration?

DNS enumeration queries DNS servers for subdomain records, while virtual host enumeration sends HTTP requests with different Host headers to the same IP, discovering virtual hosts configured on web servers. Both reveal different aspects of the attack surface.