Subdomain enumeration with subfinder, amass and AI

Subdomain enumeration finds the hostnames under a root you are allowed to test. Passive sources, certificate logs, passive DNS and search data, give you most of them without sending a packet to the target. The pattern is one tool per source, everything piped through anew so the list only grows, then httpx to see which hosts answer. The NotHoly chat triages the result: it groups hosts, flags the odd ones and drafts the note.

#One tool per source

No single tool sees every subdomain, so run a few and merge. subfinder is the fastest passive starting point.

subfinder -d example.com -all -silent | anew subs.txt

amass in passive mode reaches more sources and takes longer.

amass enum -passive -d example.com -silent | anew subs.txt

findomain and, with an API key, chaos add two more passive feeds.

findomain -t example.com -q | anew subs.txt
chaos -d example.com -silent | anew subs.txt

#anew keeps the list growing

anew appends only lines that are not already in the file and prints only what it added, so you watch new hosts arrive across runs. Point every tool at the same subs.txt and you build one deduplicated list without sort and uniq gymnastics. Re-run the commands next week and anew shows you exactly what changed.

#Resolve and probe with httpx

A name in the list is not a live host. httpx resolves each name and reports which ones answer, with status, title and tech.

httpx -l subs.txt -sc -title -td -silent -o live.txt

Expected output is one line per live host.

https://api.example.com [200] [API Gateway] [nginx]
https://dev.example.com [401] [Login] [Apache]

Read the dev, staging, api and admin prefixes first. For resolution only, dnsx is the lighter tool.

Keep context next to each host: the source that found it, the date you saw it, and whether httpx got an answer. Save subs.txt and live.txt side by side, commit them to a notes repo, and the next weekly run diffs cleanly instead of drowning you in names you already triaged.

#Hand the list to the chat

Paste live.txt into the NotHoly chat and ask it to sort signal from noise.

Here are my resolved subdomains with status and title.
Group them by likely function, flag anything that looks
like a non-production or forgotten host, and list the
five I should look at first. Give one line per choice.

The model has no access to the hosts; it reasons from the text you pasted. Use it to turn two hundred lines into a short list with reasons, then verify each one yourself in the browser or with your own requests.

#Scope and privacy

Keep enumeration inside the roots on your scope sheet. A wildcard certificate or a passive source can surface a host that belongs to a different owner, so drop it. Passive sources touch the target only when httpx probes, so run httpx last and only against in-scope names.

#Frequently asked questions

#Passive or active enumeration?

Start passive. Passive sources never send traffic to the target, so they are safe to run before you have thought about rate limits. Move to active resolution with httpx or dnsx once your list is in scope and you are ready to send requests.

#Do I need API keys?

Not to start. subfinder and amass work without keys and find more with them. Add keys for the sources you use often and keep them in each tool's config file, never on the command line.

With a live host list in hand, harvest the URLs and parameters on those hosts in crawling and URL harvesting. Back to the workflow.