Subdomain & DNS - Grimoire

subfinder

Passive subdomain discovery using public sources: run this before any active scanning to build your initial target list.

subfinder -d <domain> -o subs.txt
subfinder -d <domain> -silent | httpx -silent

httpx

Probes a list of hosts to find which are actually alive and what they’re running: cuts down the noise before you start fuzzing.

cat subs.txt | httpx -silent -status-code -title -tech-detect
httpx -l subs.txt -o live.txt -status-code -title -follow-redirects

DNS

Zone transfers are rare but still happen on misconfigured nameservers: always try before moving to brute force.

# Zone transfer
dig axfr @<nameserver> <domain>

# Subdomain brute
gobuster dns -d <domain> -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Certificate Transparency

CT logs are the most reliable passive source for subdomains: indexes every cert issued including wildcard and internal-looking names.

curl -s "https://crt.sh/?q=<domain>&output=json" | jq '.[].name_value' | sort -u