> For the complete documentation index, see [llms.txt](https://www.jdksec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.jdksec.com/methodologies/subdomain-enumeration.md).
# Basic Subdomain Enumeration guide
### Gobuster
```
gobuster -m dns -w /path/to/wordlist.txt -u domain.com -i -q >> Subdomains.tmp
cat Subdomains.tmp | grep Found |x cut -d " " -f 2 > Subdomains.txt
rm Subdomains.tmp
```
### SSL Scan
```
for i in $(cat wildcards.txt); do sslscan --no-colour --show-certificate $i | grep -E "Altnames:" | tee -a ssldomains.txt; done
cat ssldomains.txt | sed 's/DNS:/&\n/g' | cut -d "," -f 1 | sort -u > ssldomains.tmp
cat wildcards.txt >> ssldomains.tmp
cat ssldomains.tmp | sort -u > ssldomains.txt
rm ssldomains.tmp
```
### Amass
```
amass --passive -d DOMAIN.com
```
### MassDNS
```
./bin/massdns -r resolvers.txt -t AAAA -w results.txt domains.txt
```
### DNSdumpster