# Subdomain Bruteforce

> Enumerate hidden subdomains via wordlist-based bruteforce using tools like gobuster, ffuf, and amass to expand attack surface during recon.

- **URL:** https://hackindex.io/services/web/reconnaissance/subdomain-bruteforce
- **Path:** HTTP/HTTPS > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/services/web/reconnaissance.md)
- **Published:** 2026-01-23
- **Updated:** 2026-07-10

Subdomain bruteforce runs before you touch HTTP. The output becomes your host list for probing, virtual host checks, and certificate SAN expansion. Run this alongside passive recon: active bruteforce catches names that don't appear in certificate transparency logs.

After results come in, feed discovered hostnames into [virtual host enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration) and probe them with [HTTP tech fingerprinting](https://hackindex.io/services/web/enumeration/http-tech-fingerprinting).

Tools and approaches covered here:

- **ffuf** for fast HTTP-based subdomain bruteforce with wildcard filtering
- **gobuster** DNS mode for resolution-based enumeration with IP output
- **amass** for combined passive and active enumeration in one pass
- **httpx** for probing discovered hostnames and identifying live services
- Wildcard DNS detection to avoid false positives

## ffuf DNS Bruteforce

ffuf is fast and handles wildcard filtering cleanly. Use it as the primary tool:

```bash
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://FUZZ.$DOMAIN -mc 200,204,301,302,307,401,403 -v
```

If the target only runs HTTPS:

```bash
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u https://FUZZ.$DOMAIN -mc 200,204,301,302,307,401,403 -fs 0 -k
```

## Gobuster DNS Bruteforce

Gobuster DNS mode resolves names and returns IPs alongside discovered subdomains. Useful when you want to confirm resolution rather than just HTTP reachability:

```bash
gobuster dns -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 50 --show-ips -o subdomains.txt
# Found: dev.example.com [10.10.10.5]
# Found: api.example.com [10.10.10.6]
# Found: admin.example.com [10.10.10.5]
```

If you need specific resolvers to bypass split-horizon DNS or avoid caching:

```bash
gobuster dns -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -r 1.1.1.1:53 -r 8.8.8.8:53 --show-ips -o subdomains.txt
```

## Wildcard DNS Detection

If every candidate resolves, you're hitting wildcard DNS. Confirm before treating all results as valid:

```bash
dig randomstringthatshouldnotexist.$DOMAIN A
# ANSWER SECTION:
# randomstringthatshouldnotexist.example.com. 300 IN A 10.10.10.1
```

If the random name resolves, wildcard is active. With ffuf, measure the wildcard response size and filter it with `-fs SIZE`. With gobuster, use `--wildcard` to continue past wildcard detection.

## amass for Passive and Active Combined

amass combines active bruteforce with passive sources including certificate transparency, APIs, and DNS records in one run:

```bash
amass enum -d $DOMAIN -brute -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -o amass_results.txt
```

```bash
amass enum -passive -d $DOMAIN -o amass_passive.txt
```

## Probe Discovered Hosts with httpx

Once you have a hostname list, probe everything for live HTTP services in one pass. This filters dead names and gives you status codes, titles, and tech signals to prioritize:

```bash
httpx -l subdomains.txt -status-code -title -tech-detect -o live_hosts.txt
# https://dev.example.com [200] [Dev Portal] [nginx,PHP]  
# https://api.example.com [401] [API Gateway] [nginx]
# https://admin.example.com [302] [] []
```

Hostnames that resolve to the same IP as the main target are candidates for [virtual host enumeration](https://hackindex.io/services/web/enumeration/virtual-host-enumeration). Different IPs expand scope independently and each gets its own fingerprinting pass.

## References

- [Gobuster](https://github.com/OJ/gobuster) - DNS mode usage, resolver flags, and wildcard handling
- [ffuf](https://github.com/ffuf/ffuf) - Virtual host and DNS bruteforce modes with filtering
- [amass](https://github.com/owasp-amass/amass) - Passive and active subdomain enumeration combined
- [httpx: ProjectDiscovery](https://docs.projectdiscovery.io/opensource/httpx) - Fast HTTP probing with tech detection