Reconnaissance

on under Reconnaissance Recon OSINT
1 minute read
Return Home

A Penetration Tester’s Guide to Subdomain Enumeration

Sub-domain enumeration is an essential part of the reconnaissance phase. This post covers sub-domain enumeration techniques, including search engines, third-party services, certificate transparency, dictionary-based enumeration, permutation scanning, ASN scanning, zone transfers, DNSSEC zone walking, and public datasets.