Subdomain Enum

1. Basic enumeration:

   subfinder -d example.com -o subfinder_results.txt
   

2. Silent mode for clean output:

   subfinder -d example.com -silent -o subdomains.txt
   

3. Use all sources (comprehensive):

   subfinder -d example.com -all -o subdomains_all.txt
   

4. JSON output:

   subfinder -d example.com -silent -oJ -o subdomains.json
   

5. Multiple domains from file:

   subfinder -dL domains.txt -o all_subdomains.txt
   

6. Recursive enumeration:

   subfinder -d example.com -recursive -o recursive_subs.txt
   

Phase 2: Deep Enumeration (Amass)

1. Passive only:

   amass enum -passive -d example.com -o amass_passive.txt
   

2. Active enumeration:

   amass enum -active -d example.com -o amass_active.txt
   

3. With brute forcing:

   amass enum -brute -d example.com -o amass_brute.txt
   

4. JSON output:

   amass enum -d example.com -json amass_results.json
   

Phase 3: Validation (Httpx)

1. Basic probe:

   cat subdomains.txt | httpx -silent -o live_hosts.txt
   

2. With status codes:

   cat subdomains.txt | httpx -silent -sc -o live_with_status.txt
   

3. Full information:

   cat subdomains.txt | httpx -silent -sc -title -td -o detailed_hosts.txt
   

4. JSON output:

   cat subdomains.txt | httpx -silent -json -o httpx_results.json
   

5. With technology detection:

   cat subdomains.txt | httpx -silent -td -json -o tech_results.json
   

Phase 4: Combine Results

cat subfinder_results.txt amass_passive.txt | sort -u > all_subdomains.txt

Examples

Example 1: Quick Bug Bounty Recon

Scenario: Fast subdomain discovery for a bug bounty target

subfinder -d hackerone.com -silent -o subs.txt
cat subs.txt | httpx -silent -sc -title

Output: