Subdomain & live-host enumeration

SkillAI & models

Enumerate subdomains and live hosts to build the attack surface for a bug-bounty program or external assessment. Load at engagement start, on "recon", a root domain in scope, "find subdomains", or before content discovery. Signals: wildcard scope (*.target.com), a program scope list, a new external target.

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.

Then ask your AI: use the Subdomain & live-host enumeration skill

What this skill tells your AI

The instructions your AI receives, as published by noorqureshi/sploitagent in skills/recon/recon-subdomain-enum/SKILL.md and read by ahel’s review.

When it applies

External, in-scope, wildcard programs where surface = subdomains. Do this before hunting; most bugs live on forgotten hosts (staging, dev, legacy, acquisitions).

Why it works

Organizations sprint faster than they inventory. Passive sources (CT logs, DNS aggregators) plus permutation/brute-force surface hosts nobody remembers — and those skip the hardening the flagship app got.

Method

Passive (fast, quiet): subfinder -d target.com -all -silent and amass enum -passive -d target.com. Pulls CT logs, PassiveDNS, search engines — no packets to the target.
Resolve & dedupe: dnsx -l subs.txt -a -resp -silent to keep only records that resolve (drops dead CT noise) and grab their IPs.
Brute/permute for hidden hosts: puredns/shuffledns with a DNS wordlist + dnsgen permutations (dev-, -staging, region prefixes) against resolvers.
Probe live web: httpx -l resolved.txt -sc -title -tech-detect -cdn -silent → status, title, tech, CDN. This is your ranked target list.
Port sweep where allowed: naabu -l hosts.txt -top-ports 1000 to find non-web services.

Gotchas

Wildcard DNS (*.target.com → one IP) creates false positives — filter with dnsx/puredns wildcard detection before trusting a hit.
Confirm each host is in program scope before probing; out-of-scope acquisitions are a trap.
CDN/WAF IPs are shared — don't port-scan Cloudflare ranges; find origin instead.

Verify success

A deduplicated list of resolving, in-scope hosts with status/title/tech — the input to content discovery and per-class hunting.

References

ProjectDiscovery docs (subfinder/httpx/dnsx/naabu); OWASP Amass; TomNomNom recon workflow.

Signals

GitHub stars: 20
Forks: 7
Last commit: Sep 2026

Advanced

Item type: skill
Key: recon-subdomain-enum
Source: github.com/noorqureshi/sploitagent

github.com/noorqureshi/sploitagent