Subdomain brute-force enumeration is an active reconnaissance technique that discovers subdomains by testing a list of potential names against a target domain.

Process

1. Wordlist Selection

Choose a wordlist containing possible subdomain names.

• General-purpose: Common names such as www, mail, dev, admin, blog, test, staging.
• Targeted: Industry- or technology-specific names related to the target.
• Custom: A list created from OSINT or information gathered during reconnaissance.

2. Generate Potential Subdomains

The tool appends each word in the wordlist to the target domain.

Example:

Target: example.com

dev.example.com
mail.example.com
admin.example.com
api.example.com

3. Perform DNS Lookups

For each generated subdomain, the tool performs a DNS query (usually A or AAAA) to check whether the subdomain exists.

4. Filter and Validate

If a subdomain resolves to an IP address, it is considered valid. Additional checks (such as visiting the webpage or probing the service) can confirm that it is active.

Common Tools

• ffuf
• gobuster
• dnsenum
• dnsrecon