Subdomain Enum
subdomain_enumDiscover subdomains by running all installed passive sources in parallel and merging deduplicated results filtered to the engagement scope.
Instructions
Enumerate subdomains from every installed passive source and merge them.
Runs whichever of subfinder / assetfinder / findomain / amass / theHarvester are present, in parallel, and returns the deduplicated union filtered through the engagement scope. Installing more sources widens coverage with no code change — the tool set is discovered, not hardcoded.
include_amass defaults off. On a real engagement amass ran the full 15
minutes and returned zero subdomains — its productive sources want API
keys — while subfinder and assetfinder found 322 and 301. It also spawns an
amass engine child that calls setsid itself, so it escapes the
process-group kill on timeout and keeps running, unthrottled, after the
engagement believes the tool stopped. Turn it on when amass is configured
with datasource credentials; leave it off otherwise.
thorough adds slower sources (theHarvester, amass with more providers). Prefer bbot_scan when BBOT is available: it covers more sources than all of these combined.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | ||
| thorough | No | ||
| include_amass | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||