> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/dns/passive-subdomain-enumeration.md).

# Passive Subdomain Enumeration

Passive Subdomain Enumeration involves discovering subdomains of a target domain **without actively interacting** with the server. This method leverages publicly available data sources and archives, minimizing the footprint and reducing the chances of detection.

***

### **Common Tools for Passive Enumeration**

#### **1. Subfinder**

* **Source**: [GitHub - Subfinder](https://github.com/projectdiscovery/subfinder)
* A fast and reliable subdomain enumerator using multiple passive sources (approximately 30).
* Requires API keys for certain resources. [View the resource configuration guide](https://docs.projectdiscovery.io/tools/subfinder/install#post-install-configuration)

**Example:**

```bash
subfinder -all -d example.com -silent
```

***

#### **2. Findomain**

* **Source**: [GitHub - Findomain](https://github.com/Findomain/Findomain)
* Utilizes Certificate Transparency logs and other APIs to identify subdomains.
* Uses over 10 passive resources.
* Requires API keys for extended functionality. [View resource list](https://github.com/Findomain/Findomain?tab=readme-ov-file#how-does-it-work)

**Example:**

```bash
findomain --external-subdomains -u /tmp/findomain-list.txt -t example.com
```

***

#### **3. Assetfinder**

* **Source**: [GitHub - Assetfinder](https://github.com/tomnomnom/assetfinder)
* Finds subdomains related to a target using passive resources.

**Example:**

```bash
assetfinder --subs-only example.com | unfurl -u domains
```

***

#### **4. Internet Archive Sources**

#### **Gau (GetAllUrls)**

* Retrieves archived URLs from various sources, including the Wayback Machine and OTX.
* It can be used to extract subdomains from the URLs.

**Example:**

```bash
gau --subs example.com 2>/dev/null | unfurl -u domains
```

***

#### **Waybackurls**

* Fetches URLs from the Wayback Machine and extracts potential subdomains.

**Example:**

```bash
waybackurls example.com | unfurl -u domains
```

***

#### **5. Subdomain Extraction from Code Repositories**

#### **GitHub Subdomains**

* Extracts subdomains from public GitHub repositories using a personal access token.

**Example:**

```bash
github-subdomains -t {TOKEN} -d example.com -o github-subdomain
```

***

#### **GitLab Subdomains**

* Similar functionality to GitHub Subdomains, but for GitLab repositories.

**Example:**

```bash
gitlab-subdomains -t {TOKEN} -d example.com > gitlab-subdomain
```

***

### **Understanding DNS Resolution**

A DNS resolver translates human-readable domain names (e.g., `example.com`) into IP addresses by querying DNS servers.

#### **Why Use a Public Resolver List?**

Not all DNS resolvers are reliable. Using a curated list of open, fast, and accurate public DNS resolvers improves resolution efficiency.

**Recommended Resolver Lists:**

* [Trickest Resolver List](https://github.com/trickest/resolvers/blob/main/resolvers.txt)
* [Massdns Resolver List](https://github.com/blechschmidt/massdns/blob/master/lists/resolvers.txt)
* [Public-DNS](https://public-dns.info/)
* [SecLists DNS Resolvers](https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS)

***

### **Generating a Valid Public Resolver List**

#### **Tool: DNSValidator**

* Validates public resolvers against trusted DNS providers like:
  * Google DNS (`8.8.8.8` ,`8.8.4.4` )
  * Cloudflare DNS (`1.1.1.1`)

**Installation:**

```bash
git clone https://github.com/vortexau/dnsvalidator.git
cd dnsvalidator/
python3 setup.py install
```

**Generating Resolvers List:**

```bash
dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt
```

***

{% hint style="danger" %}
**Avoid** directly passing raw subdomain enumeration output from tools like Subfinder or Findomain to **httpx** or **httprobe** without verifying their DNS resolution status.
{% endhint %}

{% hint style="success" %}
Before probing for live hosts (HTTP/HTTPS), confirm that the discovered subdomains **resolve** via DNS.

#### **Recommended Tool:** [**Shuffledns**](https://github.com/projectdiscovery/shuffledns)

{% endhint %}

***

### **Manual Subdomain Discovery Techniques**

#### **Google Dorking**

Use search engine queries to uncover subdomains:

```bash
site:example.com -www
```

***

#### **GitHub Dorking**

Find exposed domains, secrets, or credentials in GitHub repositories:

```bash
org:example.com api_key
org:example.com "password="
```