Subdomain Recon Automation

Why Subdomain Recon Matters for Attack Surface Discovery

Modern organizations run dozens to hundreds of subdomains — most of which the security team has only partial visibility into. A wildcard scope like *.target.com on a bug bounty program is an open invitation to map the full asset inventory. The highest-severity findings on most programs don't come from the main application — they come from forgotten assets at the edges of the subdomain space.

Subdomain recon feeds directly into every downstream workflow: Nuclei automation, FFUF endpoint discovery, SQLMap injection testing, and attack surface prioritization. Without a comprehensive and continuously updated subdomain list, every other stage of your autonomous penetration testing pipeline is operating on incomplete data.

Why Manual Subdomain Recon Breaks

Manual subdomain enumeration — running one tool, checking the output, moving on — misses the majority of the actual subdomain space. Each tool uses different data sources: certificate transparency logs, DNS brute force, search engine indexing, ASN data, and third-party datasets. No single tool covers all of them.

Beyond coverage gaps, manual recon has no mechanism for tracking change over time. A subdomain added to scope three weeks after you ran your initial recon won't be in your list. Programs with active development cycles add new subdomains continuously — which means the attack surface you mapped on day one is stale by week two.

Passive vs Active Subdomain Recon

The distinction between passive and active recon is operational, not academic. Passive recon leaves no footprint on the target — it queries third-party data sources that already hold indexed information about the target's infrastructure. Active recon sends packets directly to the target and will appear in server logs. On bug bounty programs, the wrong sequencing — running active brute force before checking scope — is the fastest way to get banned or reported.

Passive Subdomain Recon

Passive enumeration queries external databases that aggregate DNS and certificate data without ever touching the target directly. The three primary sources are certificate transparency logs (every TLS certificate ever issued is public), passive DNS datasets (historical DNS resolution records), and search engine indexes. Combined, they surface the majority of a target's subdomain footprint with zero detection risk.

# Certificate transparency logs + passive DNS (Subfinder)
subfinder -d target.com -silent -all -o passive-sf.txt

# crt.sh + VirusTotal + Facebook CT (Assetfinder)
assetfinder --subs-only target.com > passive-af.txt

# ASN data + CT logs + passive DNS (Amass passive mode)
amass enum -passive -d target.com -o passive-am.txt

# Merge all passive results
cat passive-sf.txt passive-af.txt passive-am.txt   | sort -u   > passive-all.txt
echo "[*] Passive total: $(wc -l < passive-all.txt) subdomains"

Active Subdomain Recon

Active recon sends DNS queries or HTTP requests directly toward the target's infrastructure. It surfaces subdomains that don't exist in any public dataset — internal tooling prefixes, recently provisioned environments, and org-specific naming conventions that passive sources haven't indexed yet. Active recon should only run after confirming the program explicitly permits it and after passive enumeration is complete.

# DNS brute force with permutation wordlist (shuffledns)
shuffledns   -d target.com   -w /opt/homebrew/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt   -r /opt/homebrew/share/resolvers.txt   -silent   > active-brute.txt

# Active DNS enumeration with zone transfer attempt (Amass active)
amass enum   -active   -d target.com   -o active-amass.txt

# DNS validation of combined passive + active results
cat passive-all.txt active-brute.txt active-amass.txt   | sort -u   | dnsx -silent   > dns-validated.txt
echo "[*] DNS-validated: $(wc -l < dns-validated.txt) subdomains"

Subdomain Recon Tool Comparison

Each tool in a subdomain recon pipeline serves a distinct purpose. Understanding where each fits prevents redundant execution and ensures maximum coverage without unnecessary noise. Use the Recon Workflow Generator to auto-build pipelines from this toolset.

Real Subdomain Recon Automation Workflows

These are the actual command sequences used in production recon pipelines. Each workflow builds on the previous — start with the one-liner for quick sweeps, use the full pipeline for programs you're actively hunting on a schedule.

One-liner: Subfinder → httpx (fastest valid sweep)

The minimum viable recon pipeline. Discovers subdomains passively and immediately filters to live web hosts. Output is ready for Nuclei or FFUF without any intermediate steps.

subfinder -d target.com -silent | \
  httpx -silent -threads 50 | \
  tee live-hosts.txt

Multi-tool passive enumeration with merge

Running three passive tools and merging output maximizes subdomain coverage. Each tool hits different data sources — combining them catches subdomains that a single tool would miss. Feed the merged list into dnsx before httpx for more accurate DNS validation.

# Run three passive tools in parallel
subfinder -d target.com -silent -o subs-sf.txt &
assetfinder --subs-only target.com > subs-af.txt &
amass enum -passive -d target.com -o subs-am.txt &
wait

# Merge and deduplicate
cat subs-sf.txt subs-af.txt subs-am.txt \
  | sort -u \
  > subs-all.txt

echo "[*] Total unique subdomains: $(wc -l < subs-all.txt)"

DNS validation with dangling CNAME detection

After merging passive output, run dnsx to validate which subdomains have active DNS records and flag dangling CNAMEs. A CNAME pointing to an unclaimed S3 bucket, GitHub Pages, or Heroku app is a potential subdomain takeover — one of the most reliable high-severity finding categories in bug bounty.

# Resolve all subdomains, output with CNAME records
dnsx \
  -l subs-all.txt \
  -silent \
  -resp \
  -a -cname \
  -o dns-resolved.txt

# Extract subdomains with active DNS (no NXDOMAIN)
dnsx \
  -l subs-all.txt \
  -silent \
  > dns-valid.txt

# Check for dangling CNAMEs (potential takeover)
dnsx \
  -l subs-all.txt \
  -cname \
  -silent \
  | grep -E 'amazonaws|github\.io|heroku|azurewebsites|shopify|fastly' \
  > potential-takeovers.txt

echo "[*] Potential takeovers: $(wc -l < potential-takeovers.txt)"

Full pipeline: enum → DNS → httpx → Nuclei

The complete subdomain recon automation pipeline — from root domain to vulnerability findings in one script. This is what you schedule as a cron job on a VPS for programs you actively hunt. Integrates directly with the Nuclei automation workflow and feeds output ready for FFUF endpoint discovery.

#!/usr/bin/env bash
# PhantomRed — Full Subdomain Recon Automation Pipeline
# Usage: ./recon-full-pipeline.sh target.com
# Requires: subfinder, amass, assetfinder, dnsx, httpx, nuclei

TARGET="$1"
OUT="./recon/${TARGET}/$(date +%Y%m%d)"
mkdir -p "$OUT"

# STAGE 1 — Passive subdomain enumeration (parallel)
echo "[1/5] Passive enumeration"
/opt/homebrew/bin/subfinder -d "$TARGET" -silent -o "$OUT/sf.txt" &
/opt/homebrew/bin/assetfinder --subs-only "$TARGET" > "$OUT/af.txt" &
/opt/homebrew/bin/amass enum -passive -d "$TARGET" -o "$OUT/am.txt" &
wait

cat "$OUT/sf.txt" "$OUT/af.txt" "$OUT/am.txt" \
  | sort -u \
  > "$OUT/subs-all.txt"
echo "    Unique subdomains: $(wc -l < $OUT/subs-all.txt)"

# STAGE 2 — DNS validation
echo "[2/5] DNS validation"
/opt/homebrew/bin/dnsx \
  -l "$OUT/subs-all.txt" \
  -silent \
  -o "$OUT/dns-valid.txt"
echo "    DNS-valid: $(wc -l < $OUT/dns-valid.txt)"

# STAGE 3 — Live HTTP/HTTPS probing
echo "[3/5] Live host probing"
/opt/homebrew/bin/httpx \
  -l "$OUT/dns-valid.txt" \
  -silent \
  -threads 50 \
  -timeout 10 \
  -tech-detect \
  -status-code \
  -o "$OUT/live-hosts.txt"
echo "    Live hosts: $(wc -l < $OUT/live-hosts.txt)"

# STAGE 4 — Nuclei scan on live hosts
echo "[4/5] Nuclei scan"
/opt/homebrew/bin/nuclei \
  -l "$OUT/live-hosts.txt" \
  -t exposures/,cves/,misconfiguration/,takeovers/ \
  -severity medium,high,critical \
  -rl 50 \
  -bulk-size 25 \
  -timeout 10 \
  -silent \
  -json \
  -o "$OUT/nuclei-results.json"

# STAGE 5 — Triage summary
echo "[5/5] Triage"
/opt/homebrew/bin/jq \
  -r '[.info.severity, .host, .info.name] | @tsv' \
  "$OUT/nuclei-results.json" \
  | sort -k1 \
  > "$OUT/triage.txt"

echo "[✓] Done. Results: $OUT/triage.txt"
echo "    Critical : $(grep -c 'critical' $OUT/triage.txt 2>/dev/null || echo 0)"
echo "    High     : $(grep -c '^high' $OUT/triage.txt 2>/dev/null || echo 0)"
echo "    Medium   : $(grep -c '^medium' $OUT/triage.txt 2>/dev/null || echo 0)"

Permutation brute force with shuffledns

After passive enumeration, use shuffledns to brute-force common subdomain permutations. This catches subdomains that don't appear in any public dataset — internal tooling prefixes, numbered environments, and org-specific naming conventions.

# Brute force using a common subdomain wordlist
# SecLists: Discovery/DNS/subdomains-top1million-5000.txt
shuffledns \
  -d target.com \
  -w /opt/homebrew/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -r /opt/homebrew/share/resolvers.txt \
  -silent \
  > subs-brute.txt

# Merge with passive results
cat subs-all.txt subs-brute.txt | sort -u > subs-complete.txt

How PhantomRed Automates Subdomain Recon

PhantomRed runs the full subdomain recon pipeline server-side. Submit a target domain, configure your scope, and the platform executes Subfinder, Amass, dnsx, and httpx in sequence — then feeds the validated live-host list into Nuclei automation workflows automatically. No tool installation, no cron management, no manual pipeline wiring.

The critical difference from running scripts yourself: PhantomRed persists your subdomain inventory across sessions and runs delta detection on every re-scan. New subdomains discovered on a re-run are flagged as net-new assets and immediately swept for vulnerabilities. You get notified on new findings — not on the same 400 known subdomains you already mapped last week. See the full reconnaissance automation for bug bounty overview for context on how recon fits into the wider workflow.

Common Recon Pipeline Failures

Most recon automation failures aren't tool failures — they're sequencing and configuration failures. These are the five patterns that consistently produce bad output, wasted scan cycles, or worse, missed vulnerabilities on targets you thought you'd fully covered.

Benefits of Automated Subdomain Recon

• Continuous coverage — scheduled pipelines sweep new subdomains added to program scope automatically, so you're never operating on a stale asset inventory
• Multi-source coverage — combining Subfinder, Amass, and Assetfinder hits different data sources and consistently produces 30–50% more unique subdomains than any single tool alone
• Noise reduction — DNS validation with dnsx before HTTP probing eliminates dead hosts before they waste scan execution cycles downstream
• Takeover detection — automated CNAME analysis catches subdomain takeover opportunities that manual inspection consistently misses at scale
• Pipeline integration — structured output from httpx feeds directly into Nuclei, FFUF, and other downstream tools without manual reformatting at each stage
• Change tracking — delta detection on re-runs means you review new findings only, not the same 400 known subdomains on every scan cycle

Frequently Asked Questions