Subdomain enumeration is the process of discovering subdomains associated with a target domain (e.g., blog.example.com, mail.example.com, api.example.com). These subdomains often have their own A, AAAA, or CNAME DNS records.

1. Active Subdomain Enumeration

Active enumeration involves directly querying the target's DNS servers to discover subdomains.

Common techniques:

• DNS Zone Transfer (AXFR): Attempts to retrieve the entire DNS zone from a misconfigured DNS server (rarely successful due to security).
• Brute Force: Tests common subdomain names using wordlists (e.g., www, mail, dev, api).

Common tools:

• dnsenum
• ffuf
• gobuster

Pros: Can discover hidden subdomains.

Cons: Generates traffic and may be detected by the target.

2. Passive Subdomain Enumeration

Passive enumeration discovers subdomains without directly interacting with the target's DNS servers.

Common sources:

• Certificate Transparency (CT) Logs: SSL/TLS certificates often list subdomains in the Subject Alternative Name (SAN) field.
• Search Engines: Use search operators such as site:example.com.
• Online DNS Databases & OSINT Tools: Services that collect and index DNS information.

Pros: Stealthy and unlikely to be detected.