Table of contents
24
By Salman Khan, OSCP+, Founder of XHack, SRT (Synack Red Team member)
Read this in 30 seconds: Most subdomain enumeration guides hand you a tool list. The better question is which of four different jobs this program needs, because each one finds different names and costs different things.
- Free passive tools are mostly keyed tools. subfinder has 58 source modules, and in its current code 37 require an API key, 5 accept an optional one and 15 need none. We counted them on October 25, 2026.
- Free sources decay. subfinder’s own keyless test skips 14 sources, because they fail in its test runs, are blocked or now demand a key.
- Certificate logs shrink fast. Our own domain has 89 certificate rows in crt.sh but only 9 distinct names, and one is a wildcard that hides every host behind it.
- Brute force loads resolvers, not the target. Google Public DNS throttles above a default 1,500 queries per second per IP, and dnsx ships with its DNS rate limit switched off.
- Scope decides whether subdomain enumeration pays. A wildcard puts every subdomain in play, and a fixed list of hosts leaves nothing to find.
Subdomain enumeration is four jobs sharing one name, and running them in the wrong order wastes your API keys, your resolvers and your standing with the program.
This guide splits subdomain enumeration into its four layers, shows what each layer finds and misses, and ties each one to the kind of scope you are working. Our recon automation post covers rates and a sample pipeline, so this one goes deeper on the subdomain enumeration step itself.
We did not run these tools for this article. Every number comes from the tools’ source code and documentation, the platforms’ own pages, or one passive lookup against our own domain.
A tool list hides the real choice in subdomain enumeration. Each layer asks a different question of a different source, and each one fails in a different way.
| Layer | What it asks | Touches the target? | Main cost | What it misses |
|---|---|---|---|---|
| 1. Passive sources | Third-party datasets: scanners, DNS history, search indexes | No | API keys | Hosts no source has indexed yet |
| 2. Certificate logs | Public records of issued TLS certificates | No | Free | Hosts with no certificate, and names behind a wildcard certificate |
| 3. Brute force | A resolver: does this guessed name exist? | Not the web server. Resolvers ask the domain’s name servers | Resolver capacity, wordlist quality | Any name your list lacks |
| 4. Permutation | Variations of names you already found | Same as brute force | CPU and DNS queries | Names unlike anything you found |
Verifying which names answer, and probing the live ones, comes after all four. That is a separate step and our recon automation guide covers it.
subfinder is the usual first tool for subdomain enumeration. Its README calls it a passive subdomain enumeration tool that uses curated online sources, and it adds that many sources need API keys to work.
We counted how many. In subfinder’s current source code, each of the 58 source modules declares whether it needs a key:
That count comes from the dev branch on October 25, 2026. The latest tagged release is v2.17.0 from October 8, so a few modules may differ.
The arithmetic matters. Run subfinder with no keys and you query about 20 of its 58 sources, roughly a third.
subfinder’s test suite for keyless sources skips 14 of them, and the comments say why. Two appear blocked in the test environment, one moved to a new address, two sit behind bot protection or return a 403, and two now return errors without a key. The other seven are flaky, unavailable or under-resourced.
Those are test-run conditions, not proof that every user sees the same failures. They do show that a free source can stop working with no announcement, so a clean run on a single day is weak evidence that a name does not exist.
OWASP Amass describes itself as network mapping and asset discovery using open source information and active reconnaissance. Version 5.1.2 shipped on October 25, 2026, and the v5.1.1 notes mention a new asset database with schema changes. Its Docker Compose example sets up a PostgreSQL database, so expect more setup than a single binary.
BBOT bundles several layers in one preset. Its README shows bbot -t example.com -p subdomain-enum for the full run and -rf passive for passive sources only. The README also claims BBOT finds 20 to 50 percent more subdomains than other tools. That is the vendor’s number and we did not test it.
For subdomain enumeration, two aggregators with different sources beat running one twice. That is our judgment, not a measured result.
Every publicly trusted certificate goes into public logs, and crt.sh is the usual search page. That makes certificate transparency the best free source for subdomain enumeration of names that have ever had a certificate.
We queried it for our own domain, xhack.io, with one request and no contact with our servers. We then resolved each name with ordinary DNS lookups. The results, counts only:
*. followed by the domain). The other 8 are plain names.www name that looks like a typo.We are withholding the hostnames on purpose. The pattern is what matters.
A wildcard certificate covers every host under the domain with one entry. The log shows the wildcard and nothing about which hosts use it. So CT cannot tell us how many hosts sit behind ours, and it will not tell you either.
That is our reading of how the logs work, not a statement from a source. It is also why a short CT list from a company with a wildcard certificate should not be read as a short attack surface.
The two names that no longer resolve are still useful. A staging-style name tells you the company’s naming habit. That habit is exactly the input layer 4 needs, so keep names that stopped resolving instead of deleting them.
Brute force in subdomain enumeration takes a wordlist, builds word.example.com for each entry and asks a resolver whether it exists. The load lands on the DNS infrastructure in between.
puredns is the common tool. It uses massdns for bulk lookups and, per its README, can resolve thousands of queries per second with a good list of public resolvers. Its own documentation warns that raw results get polluted: some public resolvers return bad answers and wildcards inflate the output. It filters those by checking answers against trusted resolvers, and its defaults are 8.8.8.8 and 8.8.4.4.
Two numbers decide how fast you can go:
-rl, that is disabled by default. Nothing caps the query rate unless you set it.So you can hit a resolver’s limit with nothing more than a wordlist and default settings.
RFC 4592 explains why. A wildcard record is a template: when no record matches a queried name, the server synthesizes an answer from the wildcard. Names that really exist override it.
On a domain with wildcard DNS, every guessed name therefore answers for the record types the wildcard holds, and a brute-force list returns thousands of fakes. That is one reason puredns and dnsx include wildcard filtering.
We tested our own domain with a random label that cannot exist, and it did not resolve. So xhack.io has no wildcard record at the top level, and brute force against it would not produce that noise.
We did not read every program’s rules, and the platform guidance we did read speaks about HTTP request rates. Intigriti’s guidance on aggressive scanning says some programs allow automated tools only at 2 to 10 requests per second. None of it names DNS brute force.
That silence is not permission. If a program bans automated tools outright, ask support before you run layer 3, and keep your DNS rate low either way.
Brute force guesses from a generic list. Permutation, the last layer of subdomain enumeration, guesses from your list of real names, which is far more targeted.
If you found api.example.com, a permutation tool tries api2, api-stage, dev-api and similar variations. AlterX describes itself as a customizable subdomain wordlist generator that uses a small pattern language, and its latest release is v0.1.0 from December 2025. BBOT folds target-specific mutations into its full preset.
The names from layer 2 are the best seeds, including the ones that stopped resolving. Our own stale staging-style name is exactly the kind of input that produces a hit on a different host.
Every permutation is still a DNS query, so it runs under the same limits as layer 3.
The scope entry decides how much subdomain enumeration is worth your time. Reading it takes a minute and saves hours.
| Scope as listed | Run | Why |
|---|---|---|
| Fixed hostnames only | None. Test the listed hosts. | New names are not in scope, and testing them can cost you the reward |
Wildcard such as *.example.com | Layers 1 and 2 always. Layers 3 and 4 if the rules allow automation. | The asterisk puts every subdomain in scope unless the brief carves some out |
| Wildcard with exclusions | Same layers, then filter results through the exclusions | Out-of-scope hosts in your list are a risk, not a bonus |
| HackerOne Open Scope | Layers 1 and 2, limited to assets the program owns | Open Scope rewards owned assets by impact even when they are unlisted |
| IP ranges | Reverse DNS and host discovery instead | There is no domain to enumerate. See our host testing guide |
Bugcrowd’s scope guidance, published in 2017, says an asterisk means all subdomains are in scope unless the out-of-scope section says otherwise, and that going out of scope can mean no reward and a hit to your reputation. HackerOne lists Wildcard as its own asset type, described as a way to specify multiple domains or subdomains, and tells programs to use it for wildcard scopes.
Our post on how to choose a bug bounty program shows where the scope rating and wildcard counts appear on each platform. Our methodology guide puts this work in phase 2.
Dates and licenses for these subdomain enumeration tools come from each project’s GitHub repository, read on October 25, 2026.
| Tool | Job | License | Latest release |
|---|---|---|---|
| subfinder | Passive sources | MIT | v2.17.0, October 8, 2026 |
| Amass | Passive and active, asset database | Apache 2.0 | v5.1.2, October 25, 2026 |
| BBOT | Passive, brute force and mutations | AGPL-3.0 | v3.0.2, August 24, 2026 |
| dnsx | DNS toolkit with brute force and wildcard handling | MIT | v1.3.1, August 31, 2026 |
| AlterX | Permutation wordlists | MIT | v0.1.0, December 11, 2025 |
| puredns | Brute force with wildcard filtering | GPL-3.0 | v2.1.1, April 11, 2023 |
| massdns | Bulk resolver behind puredns | GPL-3.0 | v1.1.0, March 9, 2024 |
| assetfinder | Passive sources | MIT | No GitHub release |
Two notes on that table. The puredns repository saw activity in February 2026 even though its last release is from 2023, which in our reading means slow maintenance rather than abandonment. And assetfinder has no GitHub release and its last commit was in June 2024, so we would not build a workflow on it.
Subdomain enumeration produces a list, and a list is worth nothing until you check it. The check with the clearest payoff is dangling DNS: a name that still points at a third-party service nobody uses anymore.
Our own domain shows the shape. One of the six live names is a CNAME to a third-party service. That is the kind of record a takeover check starts from. The community repository can-i-take-over-xyz lists services and whether each can be claimed.
Reporting it carries its own rule. HackerOne’s own program closes a subdomain takeover report without a takeover proof of concept as not applicable. The repository advises claiming the name discreetly, serving a harmless file on a hidden page and serving nothing on the index page. Some programs accept a dangling-record report without a claim, so read the policy first.
A short note before the pitch: we build an agent that does recon, so discount this section accordingly.
XHack AI is not a bug bounty platform, and it does not choose your program or read its scope for you. You give the agent your scope file, your rate limit and the techniques the program bans, and it works inside those limits. For subdomain enumeration it runs up to 12 sub-agents in parallel by default, which is useful on a wide wildcard where breadth is the bottleneck.
Section 6 of our terms says you test only what you are authorized to test, and section 10.1 says AI output can be incomplete or wrong. So you still check every host the agent lists against the program’s scope before it goes anywhere near a report.
XHack does not store your agent chats and cannot access them, so your scope notes and unreported findings stay with you. Our guide to the XHack AI agent for bug bounty has the detail.
Individual plans are $20 Starter, $49 Professional and $150 Elite per month. There is a 7-day free trial, one per person. The agent finds vulnerabilities from the start, and exploitation unlocks once your identity is verified.
Subdomain enumeration is the process of finding the hostnames that belong to a target domain, such as api.example.com, so you know which assets to test. It combines passive sources, certificate logs, brute force and permutation. On a wildcard scope, subdomain enumeration is usually the first real step of recon.
Run a passive tool first, such as subfinder, because it sends nothing to the target and you can run it before you have read the rate rules. Add certificate logs next, then brute force only if the program allows automation. For subdomain enumeration, a first run without API keys uses about 20 of subfinder’s 58 sources.
Each layer of subdomain enumeration has a blind spot. Passive sources only know what they indexed, certificate logs hide names behind a wildcard certificate, and brute force only finds names in your wordlist. Free sources can also stop working without notice, so one clean run does not prove a name is absent.
The rules we read cover HTTP request rates, such as the 2 to 10 requests per second Intigriti says some programs allow, and do not name DNS brute force. If a program bans automated tools, ask its support before running it. Keep the DNS rate low in any case, since Google Public DNS throttles above 1,500 queries per second per IP.
subfinder has 58 source modules. In its current code, 37 require an API key, 5 accept an optional key and 15 need none, with one module we could not classify. Counts can shift between releases, so check with subfinder -ls on your own install.
No. If a program lists fixed hostnames only, subdomain enumeration finds names that are out of scope, and testing them can cost you the reward. It pays on wildcard scopes and on HackerOne Open Scope, where unlisted owned assets can still be rewarded.
Subdomain enumeration is a ladder, and you climb only as far as the scope and the rules allow. Start subdomain enumeration with the free layers that touch nothing, add resolver-heavy layers only when the program permits them, and keep every name that stopped resolving as input for the next round.
Before you run any subdomain enumeration, read the scope entry, set your DNS rate and write the exclusions into a file your tools check. After that, a name without a verification is only a list, so check the dangling ones first.
Categories
Related articles
