Subdomain Enum
subdomain_enumEnumerate subdomains via passive methods: Certificate Transparency logs and DNS brute-force. Non-intrusive attack surface mapping with reliability checks.
Instructions
Discover subdomains using passive methods: Certificate Transparency logs + DNS brute-force (no active probing). Use to map organization's attack surface; non-intrusive. Response carries next_calls — capped at 5 ssl_check hints (one per first-five subdomain) so triage scales to large enumerations without token bloat; pull tail entries by name when needed. Free: 30/hr, Pro: 500/hr. Returns {domain, count, subdomains, sources, found_via_wordlist, found_via_crtsh, wildcard_status, crtsh_status, warnings, summary, next_calls}. Always check wildcard_status FIRST: 'absent' means the DNS brute-force plane was meaningful; 'present' means the zone answers every name (wildcard DNS) so wordlist results were discarded and count is a certificate-transparency LOWER BOUND — report the surface as UNKNOWN, not small, and never infer low exposure from it; 'undetermined' means a negative-control probe went unanswered, so count is unverified. Then check crtsh_status: 'ok' means the CT lookup completed (so a low count is real); 'timeout' / 'rate_limited' / 'unavailable' / 'error' means CT logs did not respond and the count is wordlist-only — the actual attack surface is likely larger, retry later or surface the limitation to the user.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | Root domain to enumerate subdomains for (e.g. 'example.com', 'tesla.com') |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |