domains / families / security / subdomain-enumeration

subdomain-enumeration

separate

Map subdomains via crt.sh and subfinder at recon kickoff.

When to use

• Starting recon on any target domain.
• Production site is well-secured — find softer entry points.
• After `skill_view(name='wp-mass-recon')` — enumerate subdomains for each WordPress target.
• Building a complete asset inventory for a target organization.

Skill page

Source