The Ultimate Subdomain Recon Playbook: From DNS Dust to Subdomain Empire

In the world of cybersecurity and bug bounty hunting, a single subdomain can be the key that unlocks a critical vulnerability. The difference between finding nothing and discovering a high-severity bug often lies in the thoroughness of your reconnaissance. This playbook is your ultimate guide, designed to transform you from a beginner into a master of subdomain enumeration.

We will move methodically from the safest, most passive techniques to advanced, automated workflows. By the end, you'll have a systematic approach to uncover every potential entry point for a target organization, ensuring you find every hidden gem—online, offline, and beyond. Let's turn DNS dust into a subdomain empire.

The goal here is to find subdomains without sending a single request to the target. This is pure OSINT (Open-Source Intelligence). These cloud-based, fast, and beginner-friendly tools gather information from publicly available sources like certificate transparency logs and search engines.

crt.sh: Search certificate transparency logs.

Command: Navigate to https://crt.sh/?q=%.example.com

DNSDumpster: Provides DNS records and host information.

Command: Navigate to https://dnsdumpster.com and enter example.com.

SecurityTrails, Shodan, Censys: Powerful databases for discovering exposed assets.

Pro Tips:

Cross-Reference: Don't rely on a single tool. Combine results from crt.sh, Censys, and Shodan to get maximum coverage.

Search Engine Dorking: Use advanced Google searches like site:*.example.com to find indexed subdomains.

This phase uses powerful CLI tools run from your local machine for deep, offline analysis.

Subfinder: Passive subdomain enumeration from 50+ sources.

subfinder -d example.com -o subfinder.txt

Amass (🔴 King of Recon): Performs passive, active, and brute-force recon.

amass enum -passive -d example.com -o amass_passive.txt

Assetfinder: Finds domains using public datasets.

assetfinder --subs-only example.com > assetfinder.txt

puredns: Smart brute-forcing and wildcard filtering.

puredns bruteforce wordlist.txt example.com --resolvers resolvers.txt --write subdomains.txt

dnsx (ProjectDiscovery): Filters and validates DNS records from a list.

cat subs.txt | dnsx -a -cname -resp -silent > valid.txt

Pro Tips:

Virtual Host Brute-Forcing: Some subdomains don't have a public DNS record but are hosted on a server with an existing IP. Use ffuf to discover them by brute-forcing the Host header.

ffuf -w wordlist.txt -H "Host: FUZZ.example.com" -u http://<TARGET_IP>

This is where you find unique subdomains that are no longer actively in use but may still be vulnerable.

gau (GetAllURLs): Gathers URLs from web archives.

gau example.com | tee urls.txt

waybackurls: Another tool for retrieving URLs from the Wayback Machine.

waybackurls example.com > wayback.txt

linkfinder: Parses JS files and extracts endpoints.

python3 linkfinder.py -i https://example.com/app.js -o cli

hakrawler: Crawls a website to find subdomains.

echo "https://example.com" | hakrawler -subs -js -depth 3

Pro Tips:

DNS Record Analysis: Don't just look for A or CNAME records. Use dig to query for MX (mail), TXT (text), and SRV (service) records, as they can sometimes contain clues to other subdomains.

This is an advanced technique for uncovering domains that passive methods would never find.

dnsgen: Generates permutations from a list of subdomains.

dnsgen subs.txt > permutated.txt

altdns: Takes a list of subdomains and a wordlist to create mutations.

altdns -i subs.txt -o data_output -w words.txt -r -s results.txt

Pro Tips:

Targeted Mutations: Feed a list of known internal subdomains (e.g., dev.example.com) into dnsgen to create highly specific new subdomains like dev-staging.example.com.

Phase 5: Automation Stack Combo

This is the final, most efficient step. Don't run tools manually—create a pipeline.

Chaos: ProjectDiscovery's maintained dataset of known subdomains.

chaos -d example.com -o chaos.txt

httpx (ProjectDiscovery): Filters, probes, and gathers initial information.

cat subs.txt | httpx -silent -status-code -title -tech-detect > live_subs.txt

OneForAll: All-in-one passive and active subdomain recon tool.

python3 oneforall.py --target example.com run

ReconFTW: A fully automated recon pipeline using Amass, Subfinder, dnsx, gau, and more.

# Set up and run the ReconFTW script

python3 reconftw.py -d example.com

Pro Tips:

Build Your Own Pipeline: Learn to chain commands using | (pipes) to create a custom, automated workflow.

subfinder -d example.com | sort -u | httpx -silent -o final_subs.txt

Filtering is Key: After gathering your subdomains, use httpx to filter out dead or non-responsive ones. This is crucial for reducing false positives and saving time on future scans.

Conclusion: Your Post-Recon Workflow

Reconnaissance is a marathon, not a sprint. Follow this final checklist to ensure you've done everything to "recon like a pro."

✅ Use Passive + Active + Brute-force: Never rely on just one method.

✅ Combine Online Tools + CLI + Archives: A multi-layered approach guarantees maximum coverage.

✅ Validate with DNS Resolvers: Confirm your subdomains with tools like dnsx.

✅ Filter and Validate: Use httpx to remove dead domains and gather initial information.

After you have your final, clean list of subdomains, the real work begins. Here's a brief post-recon workflow:

Subdomain Takeover: Check for vulnerable subdomain takeovers with subjack and nuclei.

nuclei -l final_subs.txt -t cves/subdomain-takeover

Port Scanning: Discover open ports and services on your live subdomains using a fast scanner like naabu.

cat final_subs.txt | naabu -o ports.txt

Vulnerability Scanning: Use nuclei with its comprehensive template library to perform a rapid scan for common vulnerabilities.

nuclei -l final_subs.txt -t cves/ -c 25 -o vulns.txt

By systematically executing this playbook, you will consistently find more subdomains than your peers, giving you a significant advantage in any bug bounty program or security assessment. Happy hunting!