Mapping the External Boundary
Subdomain enumeration is the process of identifying all child hostnames associated with a root domain. It is the foundational phase of any external security audit.
Why Mapping Subdomains is Critical
Organizations often have hundreds of active subdomains. Some are managed, while others are forgotten development interfaces or legacy servers.
By enumerating subdomains, you can:
- Discover Shadow IT: Locate testing servers or administrative panels deployed without the knowledge of the central security team.
- Prevent Cookie Stealing: Find vulnerable subdomains that could allow attackers to hijack session cookies scoped to
*.example.com. - Identify Target Services: Pinpoint specific hostnames (e.g.,
vpn.example.com,git.example.com) that indicate valuable entry points.
Active vs. Passive Enumeration
- Active Enumeration: Sending direct queries and brute-forcing namespaces against the target nameservers.
- Passive Enumeration: Querying public repositories, Certificate Transparency ledgers, and index caches.