Skip to content
HackIndex logo

HackIndex

Subdomain Bruteforce

4 min read Jul 10, 2026

Subdomain bruteforce runs before you touch HTTP. The output becomes your host list for probing, virtual host checks, and certificate SAN expansion. Run this alongside passive recon — active bruteforce catches names that don't appear in certificate transparency logs.

After results come in, feed discovered hostnames into virtual host enumeration and probe them with HTTP tech fingerprinting.

ffuf DNS Bruteforce

ffuf is fast and handles wildcard filtering cleanly. Use it as the primary tool:

┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://FUZZ.$DOMAIN -mc 200,204,301,302,307,401,403 -v
Explain command
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt Wordlist file path used for fuzzing input.
-u http://FUZZ.$DOMAIN Target URL with FUZZ keyword as subdomain injection point.
-mc 200,204,301,302,307,401,403 Match only responses with these HTTP status codes.
-v Enable verbose output, showing full URLs and redirects.

If the target only runs HTTPS:

┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u https://FUZZ.$DOMAIN -mc 200,204,301,302,307,401,403 -fs 0 -k
Explain command
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt Wordlist file path used for fuzzing input substitution.
-u https://FUZZ.$DOMAIN Target URL template; FUZZ keyword is replaced with wordlist entries.
-mc 200,204,301,302,307,401,403 Match only responses with these HTTP status codes.
-fs 0 Filter out responses with a body size of 0 bytes.
-k Disable TLS/SSL certificate verification.

Gobuster DNS Bruteforce

Gobuster DNS mode resolves names and returns IPs alongside discovered subdomains. Useful when you want to confirm resolution rather than just HTTP reachability:

┌──(kali㉿kali)-[~]
└─$ gobuster dns -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 50 --show-ips -o subdomains.txt 
Found: dev.example.com [10.10.10.5]
Found: api.example.com [10.10.10.6]
Found: admin.example.com [10.10.10.5]
Explain command
dns Use DNS subdomain enumeration mode.
-d $DOMAIN Target domain to enumerate subdomains against.
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt Wordlist file containing subdomain candidates to test.
-t 50 Number of concurrent threads to use for requests.
--show-ips Display resolved IP addresses alongside discovered subdomains.
-o subdomains.txt Write output results to the specified file.

If you need specific resolvers to bypass split-horizon DNS or avoid caching:

┌──(kali㉿kali)-[~]
└─$ gobuster dns -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -r 1.1.1.1:53 -r 8.8.8.8:53 --show-ips -o subdomains.txt
Explain command
dns Use DNS subdomain enumeration mode.
-d $DOMAIN Target domain to enumerate subdomains against.
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt Wordlist file containing subdomain candidates.
-r 1.1.1.1:53 Custom DNS resolver; use Cloudflare DNS at port 53.
-r 8.8.8.8:53 Additional custom DNS resolver; use Google DNS at port 53.
--show-ips Display resolved IP addresses alongside discovered subdomains.
-o subdomains.txt Write output results to the specified file.

Wildcard DNS Detection

If every candidate resolves, you're hitting wildcard DNS. Confirm before treating all results as valid:

┌──(kali㉿kali)-[~]
└─$ dig randomstringthatshouldnotexist.$DOMAIN A 
ANSWER SECTION:
randomstringthatshouldnotexist.example.com. 300 IN A 10.10.10.1
Explain command
randomstringthatshouldnotexist.$DOMAIN Intentionally invalid subdomain used to test NXDOMAIN or DNS wildcard behavior.
A Requests only IPv4 address (A) DNS records for the target domain.

If the random name resolves, wildcard is active. With ffuf, measure the wildcard response size and filter it with -fs SIZE. With gobuster, use --wildcard to continue past wildcard detection.

amass for Passive and Active Combined

amass combines active bruteforce with passive sources including certificate transparency, APIs, and DNS records in one run:

┌──(kali㉿kali)-[~]
└─$ amass enum -d $DOMAIN -brute -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -o amass_results.txt
Explain command
enum Subcommand to perform network enumeration and asset discovery.
-d $DOMAIN Target domain to perform enumeration against.
-brute Enable brute-force DNS subdomain enumeration.
-w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt Wordlist file used for brute-force subdomain discovery.
-o amass_results.txt Write enumeration output to the specified file.
┌──(kali㉿kali)-[~]
└─$ amass enum -passive -d $DOMAIN -o amass_passive.txt
Explain command
enum Subcommand to perform DNS enumeration and mapping.
-passive Use only passive data sources; no direct DNS queries to target.
-d $DOMAIN Specifies the target domain to enumerate.
-o amass_passive.txt Writes discovered names/results to the specified output file.

Probe Discovered Hosts with httpx

Once you have a hostname list, probe everything for live HTTP services in one pass. This filters dead names and gives you status codes, titles, and tech signals to prioritize:

┌──(kali㉿kali)-[~]
└─$ httpx -l subdomains.txt -status-code -title -tech-detect -o live_hosts.txt 
https://dev.example.com [200] [Dev Portal] [nginx,PHP]  
https://api.example.com [401] [API Gateway] [nginx]
https://admin.example.com [302] [] []
Explain command
-l subdomains.txt Read targets from the specified input file.
-status-code Display HTTP status code in the output.
-title Display the page title of each HTTP response.
-tech-detect Detect technologies used by the web application.
-o live_hosts.txt Write output results to the specified file.

Hostnames that resolve to the same IP as the main target are candidates for virtual host enumeration. Different IPs expand scope independently and each gets its own fingerprinting pass.

References