subdomainenumlisted

# SubdomainEnum Subdomain enumeration following Jason Haddix's Bug Hunter's Methodology (TBHM), with intelligent target prioritization. **Philosophy:** > "For every subdomain you find, you 2x your chance of hacking the target. > For every apex domain you find, you 4x your chance of hacking the target." > — Jason Haddix ## Workflow Routing | Workflow | Trigger | What It Does | |----------|---------|--------------| | **Light** | "quick subdomains", "fast enum", "light recon", "find subdomains", DEFAULT | subfinder -all → httpx probe → prioritize | | **Full** | "full enum", "comprehensive", "all subdomains", "thorough recon", "full recon" | All tools parallel → aggregate → httpx probe → prioritize | | **Probe** | "probe subdomains", "check live hosts" | httpx against provided list → prioritize | **When executing, announce:** ``` Running the **Light** workflow from **SubdomainEnum**... ``` --- ## Light Workflow (Default) **When to use:** Quick reconnaissance, time-sensitive, initial target assessment. **Time:** 1-5 minutes **Tools:** subfinder, httpx, PrioritizeTargets ### Steps 1. **Create output directory:** ```bash mkdir -p recon_{domain}_{timestamp} cd recon_{domain}_{timestamp} ``` 2. **Run subfinder with all sources:** ```bash subfinder -d {domain} -all -o subdomains-raw.txt ``` 3. **Deduplicate and sort:** ```bash sort -u subdomains-raw.txt > subdomains.txt echo "Found $(wc -l < subdomains.txt) subdomains" ``` 4. **Probe with httpx (JSON for prioritization):