subdomain_enum
Map an organization's attack surface by discovering subdomains through passive Certificate Transparency logs and DNS brute-force, without active probing.
Instructions
Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force (no active probing). Use to map organization's attack surface; non-intrusive. Response carries next_calls — capped at 5 ssl_check hints (one per first-five subdomain) so triage scales to large enumerations without token bloat; pull tail entries by name when needed. Free: 30/hr, Pro: 500/hr. Returns {domain, count, subdomains, sources, found_via_wordlist, found_via_crtsh, crtsh_status, warnings, summary, next_calls}. Always check crtsh_status: 'ok' means the CT lookup completed (so a low count is real); 'timeout' / 'rate_limited' / 'unavailable' / 'error' means CT logs did not respond and the count is wordlist-only — the actual attack surface is likely larger, retry later or surface the limitation to the user.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Root domain to enumerate subdomains for (e.g. 'example.com', 'tesla.com') |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |