CyberShield

  Welcome back to our Cybersecurity series! We have completed our initial 20-post journey, but the learning never stops. Today, we are diving deep into the most critical part of the Reconnaissance phase: Subdomain Enumeration . What is Subdomain Enumeration? Subdomain Enumeration is the process of finding all the subdomains (e.g., dev.example.com , api.example.com , staging.example.com ) associated with a main domain ( example.com ). Professional hackers spend a lot of time here because main domains are usually highly secured, but subdomains—especially those used for development or testing—often have weak security, unpatched software, or hidden admin panels. Why Should You Care About Subdomains? Hidden Assets: Companies often forget about old subdomains that might contain sensitive data or old backup files. Increased Attack Surface: Every new subdomain is a new chance to find a bug like SQLi, XSS, or SSRF. Subdomain Takeover: Sometimes, a subdomain points to a service (like Gi...

Introduction Subdomain enumeration is a crucial step in reconnaissance for penetration testing and bug bounty hunting. Finding hidden subdomains can reveal additional attack surfaces. One of the most efficient tools for this task is Subfinder. What is Subfinder? Subfinder is a fast and powerful subdomain discovery tool designed to find valid subdomains using passive sources. It is widely used by security researchers for reconnaissance. Key Features Passive subdomain enumeration Fast and lightweight Uses multiple data sources Easy to use Suitable for bug bounty workflows Why Subdomain Enumeration Matters Subdomains often expose: Admin panels APIs Development environments Misconfigured services These can lead to vulnerabilities. Installation Install Subfinder using Go: go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest Make sure your PATH is configured correctly. Basic Usage subfinder -d example.com This command finds subdomains of the target domain. Save Output ...