Enumerate Subdomains

Subdomains are one of the most overlooked parts of an organization's attack surface. While the main website gets regular security attention, subdomains like staging.company.com, old-api.company.com, or test-admin.company.com often run outdated software with known vulnerabilities. Attackers know this and routinely enumerate subdomains as the first step in targeting an organization.

Subdomain enumeration discovers all subdomains associated with a domain by probing DNS records, certificate transparency logs, and live host responses. The probe_hosts skill identifies which discovered subdomains have live HTTP services and what technologies they are running.

This is fundamental to any security assessment. You cannot protect subdomains you do not know about. Regular enumeration helps security teams maintain an accurate inventory, identify shadow IT, discover forgotten services, and ensure every subdomain meets the organization's security baseline. It is also the foundation for targeted vulnerability scanning -- once you know all your subdomains, you can test each one systematically.