Quick answer: Subdomain discovery (subdomain enumeration) is the task of surfacing all the subdomains tied to an organization's main domain (for example panel.site.com, test.site.com, vpn.site.com). It is a core step of the reconnaissance phase of a penetration test because each subdomain is a new attack surface. It is done with passive (certificate records, DNS datasets) and active (DNS brute force) methods. Old or test subdomains the organization often forgot are the attacker's easiest entry points.

Why is subdomain discovery critical?

An organization's attack surface is not just its main website. Behind it there may be dozens of subdomains: admin panels, test environments, old applications, VPN endpoints, development servers. Many of these are forgotten over time, not updated and weakly protected. For an attacker these forgotten subdomains are much easier targets than the well protected main site.

So in the reconnaissance phase the real question should not be "is the main site secure" but "what is the organization's entire invisible surface." You cannot protect a subdomain you cannot see.

Passive and active discovery methods

Method Source Characteristic
Certificate transparency CT logs (crt.sh) Passive, no contact with target
DNS datasets Passive DNS, search engines Passive, broad coverage
DNS brute force Trying with a wordlist Active, finds new subdomains
Permutation Deriving from known names Active, generates variations
Subdomain takeover check Detecting abandoned CNAMEs Takeoverable subdomain

Passive methods gather information from public records without contacting the target directly. Active methods find new subdomains by sending queries to DNS. Together they provide the broadest coverage.

Subdomain takeover risk

A critical finding often encountered in reconnaissance is a subdomain pointing to an abandoned service. For example, if a subdomain is linked by CNAME to a cloud service no longer in use, the attacker can claim that service in their own name and take over the subdomain. This is a "subdomain takeover" attack and must be checked in the reconnaissance phase.

The KAOS and DSET approach

In the reconnaissance phase of penetration tests, DSET surfaces all of an organization's known and unknown subdomains and evaluates the attack surface of each. Our KAOS security engine finds subdomains through passive and active discovery and flags abandoned and takeoverable ones (subdomain takeover). In our field experience the most common situation is a forgotten test or old subdomain left open with weak protection. Our goal is to make the organization's real external surface visible.

Related reading: OSINT and passive information gathering, subdomain takeover abandoned subdomain, attack surface management ASM, network reconnaissance with Nmap, directory and content discovery gobuster ffuf, DNS security tunneling hijacking.

Frequently asked questions

What is the difference between passive and active subdomain discovery? Passive discovery gathers subdomains from public records (certificate transparency logs, passive DNS datasets) without directly contacting the target. Active discovery sends queries directly to DNS, trying to find new subdomains with a wordlist. The passive method leaves no trace, the active method is more comprehensive; together they give the best result.

What is subdomain takeover? It is when a subdomain points by CNAME to a service that no longer exists or has been abandoned (for example a removed cloud resource). The attacker registers that service in their own name, takes over the subdomain and can publish content under the organization's name. Abandoned CNAME records must be checked in the reconnaissance phase.

How do I discover my own subdomains? First scan public records with certificate transparency logs and passive DNS, then find unknown subdomains with DNS brute force. Inventory each subdomain found, determine its owner and purpose, and close the abandoned ones. This discovery should be regular, not one time.

Sources

To discover your organization's external attack surface and subdomains, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.