Subdomain Discovery

# RULES OF ENGAGEMENT (always re-read)
#   - In-scope domains:      example.com, *.example.com
#   - Authorised activity:   passive enumeration, light active probing
#   - Out-of-scope:          subsidiary domains, third-party services
#   - Rate limits:           respect target infrastructure
#   - Reporting:             findings to security@example.com within 24h

# 1) Install
#   snap install amass             # Ubuntu
#   brew install amass             # macOS
#   docker run caffix/amass        # container

# 2) Passive enumeration — no traffic hits the target
amass enum -passive -d example.com -o passive.txt
# Pulls from cert transparency, DNS history archives, search engine indices.
# Quiet, polite, often comprehensive.

# 3) Active enumeration — adds DNS brute-forcing + zone walking
#   ONLY do this if active probing is in scope.
amass enum -active -d example.com -brute -w wordlists/subdomains-top1m.txt -o active.txt

# 4) Add API integrations for more sources — config.yaml
#   datasources:
#     - name: VirusTotal
#       apikey: $VT_API_KEY
#     - name: SecurityTrails
#       apikey: $ST_API_KEY
#     - name: Censys
#       apiid:  $CENSYS_ID
#       apikey: $CENSYS_KEY
amass enum -passive -d example.com -config config.yaml

# 5) Visualise the attack surface (relationships graph)
amass viz -d3 -d example.com -dir ./out
# Opens out/index.html — interactive graph of subdomain ↔ ASN ↔ netblock

# 6) Track changes over time — store output in the graph DB
amass enum -passive -d example.com
amass track -d example.com -since '2026-04-01T00:00:00Z'
# Diffs new subdomains since the cutoff — gold for ongoing recon

# 7) Combine with other tools (the ethical-hacker pipeline)
amass enum -passive -d example.com -o subs.txt
cat subs.txt | httpx -silent -title -tech-detect -status-code -o live.txt
cat live.txt | nuclei -t ~/nuclei-templates/ -o findings.txt

# 8) Report what you find — a defender-friendly format
#   - Subdomain                      Notes
#   - api-staging.example.com        Staging exposed publicly — recommend IP allowlist
#   - old-marketing.example.com      Resolves but no service — recommend DNS cleanup
#   - admin.example.com              HTTP 401 — Basic auth, recommend stronger MFA

# 9) Defender's counterpart — how to detect this against your org
#   - Cert Transparency monitoring (Google CT logs, Cert Spotter, crt.sh)
#   - DNS zone reviewing — flag any subdomain not in your IPAM
#   - Honeytoken subdomains: register a never-used subdomain, alert on any DNS hits
#   - Limit DNS brute-force surface: don't have wildcard A records resolving everything

# 10) Legality + ethics
#   - Subdomain enumeration is generally lawful (public DNS data), but PORT SCANNING
#     or vulnerability probing on systems you don't have permission to test is NOT.
#   - Always: signed authorisation, defined scope, defined timing, defined reporting path.

# Discover subdomains for AUTHORISED scope:
amass enum -d example.com -o subs.txt
# Or pull from CT logs:
curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u