Probing DNS Infrastructure directly
Unlike passive reconnaissance, active subdomain enumeration involves sending direct queries to target DNS authoritative nameservers to resolve hostnames.
Core Active Techniques
1. Dictionary Brute-Forcing: Querying nameservers for a list of words prefixed to the root domain (e.g. admin.example.com, test.example.com).
2. DNS Zone Transfers (AXFR): Attempting to query the zone configuration directly. If a nameserver is misconfigured, it will transmit the complete DNS database to the client.
3. DNS Wildcard Detection: Verifying if the nameserver responds with a valid record for non-existent domains. Active scanners must detect wildcards to filter false positives.