메뉴
Subdomain enumeration and DNS reconnaissance using subfinder, amass, dnsx, and other tools. Use this skill when user needs to discover subdomains, perform DNS enumeration, gather DNS records, or find hidden subdomains of a target domain.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | recon-subdomain |
| description | Subdomain enumeration and DNS reconnaissance using subfinder, amass, dnsx, and other tools. Use this skill when user needs to discover subdomains, perform DNS enumeration, gather DNS records, or find hidden subdomains of a target domain. |
IMPORTANT: Subdomain enumeration without proper authorization may violate terms of service. Always ensure you have:
Required tools that must be installed on your system:
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latestgo install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latestOptional tools:
go install -v github.com/owasp-amass/amass/v4/cmd/amass@latestgo install github.com/tomnomnom/assetfinder@latestgo install github.com/d3mondev/puredns/v2@latestMost commonly used commands for subdomain enumeration:
subfinder -d example.com -o subs.txt
subfinder -d example.com -silent | dnsx -silent -resp > resolved_subs.txt
amass enum -passive -d example.com -o amass_subs.txt
subfinder -d example.com -silent | tee subs1.txt && \
assetfinder --subs-only example.com | tee subs2.txt && \
cat subs1.txt subs2.txt | sort -u > all_subs.txt
When you need fast subdomain discovery without direct interaction:
subfinder -d example.com -o subs.txt
Parameters:
-d example.com - Target domain-o subs.txt - Output file-silent - Suppress stderr output (optional)Example:
subfinder -d target.com -o target_subs.txt
subfinder -d target.com -silent | head -20
When you need comprehensive active enumeration:
amass enum -active -d example.com -o amass_active.txt
Parameters:
-active - Active enumeration (direct DNS queries)-d example.com - Target domain-o amass_active.txt - Output fileExample:
amass enum -active -d target.com -o target_amass.txt
Passive mode (no direct queries):
amass enum -passive -d example.com -o amass_passive.txt
When you have a list of subdomains and need to verify which resolve:
dnsx -l subs.txt -o resolved.txt
Parameters:
-l subs.txt - Input file with subdomains-o resolved.txt - Output file-resp - Include DNS responses in output-json - Output in JSON formatExample:
dnsx -l target_subs.txt -o resolved.txt -resp
With response details:
dnsx -l subs.txt -resp -json -o resolved.json
When you need to gather specific DNS records:
# A records
dnsx -l subs.txt -a -only-a
# AAAA records (IPv6)
dnsx -l subs.txt -aaaa -only-aaaa
# CNAME records
dnsx -l subs.txt -cname -only-cname
# TXT records
dnsx -l subs.txt -txt -only-txt
# MX records
dnsx -l subs.txt -mx -only-mx
# All records
dnsx -l subs.txt -a -aaaa -cname -mx -txt -ns -soa
When the target has wildcard DNS records:
# Detect wildcard subdomains
puredns discard wildcards.txt < subs.txt > valid_subs.txt
Alternative with dnsx:
# Test for wildcard
echo "randomtest12345.example.com" | dnsx -silent
# If resolves, wildcard exists
# Remove wildcard responses
dnsx -l subs.txt -silent -rcode,noerror | grep -v "randomtest"
When you need to discover subdomains via wordlist:
# Using puredns
puredns bruteforce wordlist.txt example.com | tee brute_subs.txt
Common wordlists:
# SecLists
puredns bruteforce /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt example.com
Combine multiple tools for maximum coverage:
# Create output file
> all_subs.txt
# Run subfinder
subfinder -d example.com -silent >> all_subs.txt
# Run assetfinder
assetfinder --subs-only example.com >> all_subs.txt
# Run amass (passive)
amass enum -passive -d example.com >> all_subs.txt
# Sort and deduplicate
sort -u all_subs.txt -o all_subs.txt
Find subdomains from SSL/TLS certificates:
# Using crt.sh (web)
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
jq -r '.[].name_value' | sort -u > ct_subs.txt
# Using subfinder (CT integration)
subfinder -d example.com -sources crtsh -o ct_subs.txt
Attempt zone transfer (rarely successful but worth trying):
# Try zone transfer
dig axfr @ns1.example.com example.com
# With specific nameserver
host -t axfr example.com ns1.example.com
Check for dangling DNS records:
# Using subjack
subjack -w subs.txt -t 100 -timeout 10 -o takeovers.txt
# Using nuclei (requires templates)
nuclei -l subs.txt -t /path/to/takeover-templates/
| Scenario | Recommended Tool | Command |
|---|---|---|
| Quick passive discovery | subfinder | subfinder -d <domain> -o subs.txt |
| Comprehensive enumeration | amass | amass enum -d <domain> -o subs.txt |
| DNS resolution verification | dnsx | dnsx -l subs.txt -o resolved.txt |
| Certificate search | subfinder (crtsh) | subfinder -d <domain> -sources crtsh |
| Brute force | puredns | puredns bruteforce wordlist.txt <domain> |
| Wildcard handling | puredns | puredns discard wildcards.txt < subs.txt |
| Simple alternative | assetfinder | assetfinder --subs-only <domain> |
Tool Comparison:
| Tool | Speed | Coverage | Passive | Active | Use Case |
|---|---|---|---|---|---|
| subfinder | Fast | Good | Yes | Limited | Quick discovery |
| amass | Slow | Excellent | Yes | Yes | Comprehensive |
| assetfinder | Very Fast | Basic | Yes | No | Quick checks |
| puredns | Fast | N/A | No | Yes | Brute force |
Subdomain brute forcing wordlists:
| Wordlist | Size | Source |
|---|---|---|
| subdomains-top1million-5k | 5,000 | SecLists |
| subdomains-top1million-20k | 20,000 | SecLists |
| subdomains-top1million-500k | 500,000 | SecLists |
| DNS-Jaded-Top.txt | ~10,000 | Assetnote wordlists |
Example usage:
puredns bruteforce /path/to/subdomains-top1million-5000.txt example.com
Complete subdomain enumeration workflow:
# 1. Passive enumeration
subfinder -d target.com -silent > passive.txt
amass enum -passive -d target.com >> passive.txt
assetfinder --subs-only target.com >> passive.txt
sort -u passive.txt -o passive.txt
# 2. Resolve subdomains
dnsx -l passive.txt -silent -o resolved.txt
# 3. Check for alive HTTP services
cat resolved.txt | httpx -silent -status-code -title > alive.txt
# 4. Brute force (optional)
puredns bruteforce wordlist.txt target.com > brute.txt
dnsx -l brute.txt -silent >> resolved.txt
# 5. Final sorted list
sort -u resolved.txt -o final_subs.txt
subfinder -d example.com -json -o subs.json
JSON structure:
{
"host": "sub.example.com",
"source": "crtsh"
}
dnsx -l subs.txt -json -o resolved.json
JSON structure:
{
"host": "sub.example.com",
"a": ["1.2.3.4"],
"aaaa": [],
"cname": [],
"status": "resolved"
}
When you need to persist subdomain discovery results to the database:
# Store from file (flat hierarchy)
subfinder -d example.com | python .claude/skills/recon-subdomain/scripts/subdomain_storage.py
# Store from file with subsystem
subfinder -d example.com | python .claude/skills/recon-subdomain/scripts/subdomain_storage.py \
--subsystem "External Infrastructure"
# Store from file (alternative)
python .claude/skills/recon-subdomain/scripts/subdomain_storage.py \
--input-file subdomains.txt \
--subsystem "Customer A"
Parameters:
--subsystem - Subsystem name (optional, omit for flat hierarchy)--input-file - File containing subdomains (one per line, optional, reads from stdin if not provided)Database location: ./data/results.db
Related skills: results-storage - Query data, generate reports
scripts/merge_subdomains.py - Merge and deduplicate multiple subdomain listsscripts/filter_resolved.py - Filter resolved subdomains with custom resolution logicscripts/subdomain_stats.py - Generate statistics on discovered subdomainsreferences/subfinder_guide.md - Comprehensive subfinder referencereferences/amass_guide.md - Detailed amass usage documentationreferences/dnsx_guide.md - DNS resolution tool referencereferences/dns_techniques.md - Advanced DNS enumeration techniquesassets/subdomains-top1m-5k.txt - Top 5,000 common subdomain wordsassets/resolvers.txt - Trusted DNS resolver listassets/wildcard-test.txt - Subdomain wildcard testing patterns本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf 等工具测试 LFI 漏洞，支持路径遍历、PHP 伪协议利用、日志投毒 RCE、敏感文件读取。当用户需要检测 LFI 漏洞、利用文件包含漏洞读取服务器文件时使用此技能。
SQL injection detection and exploitation using sqlmap, manual techniques, and custom payloads. Use this skill when user needs to test for SQL injection vulnerabilities, extract database information, or exploit SQLi in parameters, headers, or cookies.
按照标准格式生成渗透测试报告，包含项目信息表、漏洞发现清单、漏洞详情（含属性表、描述、复现步骤、证据截图、修复建议）、附录（风险等级定义、CVSS说明、词汇表）。当用户要求生成渗透测试报告、安全测试报告、漏洞报告时使用此技能。严格遵循项目模板目录中的标准格式。
任意文件下载与本地文件包含 (LFI) 漏洞检测和利用工具。使用 curl、ffuf、wget 等工具测试文件下载漏洞，支持路径遍历、伪协议利用、敏感文件读取。当用户需要测试文件下载功能、检测 LFI 漏洞、读取服务器敏感文件时使用此技能。
Arbitrary file download vulnerability detection and exploitation using path traversal techniques, bypass methods, and sensitive file discovery. Use this skill when user needs to test for file download vulnerabilities, path traversal, or read sensitive files on target systems.
Cross-site scripting (XSS) vulnerability detection and exploitation. Supports reflected XSS, stored XSS, DOM-based XSS, and blind XSS testing. Use this skill when user mentions XSS, cross-site scripting, script injection, or needs to test JavaScript injection in parameters, forms, headers, or DOM sources.