A high-performance reconnaissance tool that discovers subdomains via DNS brute-forcing and certificate transparency log mining.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install subdomain-enum
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install subdomain-enum using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Subdomain Enumerator?
The Subdomain Enumerator is a specialized utility designed for infrastructure mapping and security reconnaissance. As part of the Openclaw Skills library, it provides a dual-method approach to surface hidden or forgotten subdomains without requiring expensive third-party API keys. By combining active DNS resolution with passive certificate transparency (CT) log mining, it offers a more complete view of a domain's attack surface than traditional scanners.
This skill is particularly valuable for security researchers and DevOps engineers who need to audit infrastructure exposure. It integrates seamlessly into automated workflows, supporting multi-threaded operations and structured data exports to ensure speed and interoperability with other security tools.
Subdomain Enumerator Use Cases
- Performing initial reconnaissance for bug bounty programs or security audits.
- Identifying forgotten staging or development servers (e.g., staging.example.com).
- Mapping the full digital footprint of an organization for asset management.
- Auditing SSL/TLS certificates issued to a domain to find undocumented services.
- Validating DNS health and identifying orphaned records.
How Subdomain Enumerator Works
- Passive Discovery: The tool queries crt.sh to extract subdomains from public Certificate Transparency logs, capturing domains that might not be in common wordlists.
- Active Resolution: It performs high-speed DNS brute-forcing by appending words from a list to the target domain and checking for valid IP responses.
- Concurrent Processing: Tasks are distributed across multiple threads to maximize throughput and reduce scan time.
- Data Aggregation: Results from both methods are merged, deduplicated, and resolved to provide a clean list of unique, active subdomains.
- Output Generation: The final list is displayed in the terminal or saved to a file in either plain text or JSON format for further analysis.
Subdomain Enumerator Setup
To use this tool within your Openclaw Skills environment, ensure you have Python and the necessary dependencies installed:
# Install required Python packages
pip install requests
# Run a basic scan immediately
python3 scripts/subenum.py example.com
Subdomain Enumerator Data Schema & Taxonomy
The skill organizes discovery data into structured formats to facilitate integration into larger Openclaw Skills workflows.
| Data Point | Type | Description |
|---|---|---|
| Subdomain | String | The fully qualified domain name (FQDN) discovered |
| IP Address | String | The resolved IPv4 address for active domains |
| Source | String | Indicates if found via 'DNS Brute-force' or 'crt.sh' |
| Timestamp | Date | The date and time of the scan execution |
When using the --json flag, the output provides a machine-readable array of objects for automated processing.
Subdomain Enumerator Advanced Features
- Multi-Source Hybrid Scanning: Combines active DNS resolution with passive CT log mining for maximum coverage.
- Configurable Threading: Adjust concurrency with the
-tflag to balance speed against network load. - Custom Wordlist Support: Inject industry-standard lists like SecLists to perform deep-dive brute-force attacks.
- JSON Interoperability: Export findings in JSON format to pipe results directly into other security tools or databases.
- Stealth Controls: Use the
--no-crtshflag to limit discovery to active DNS queries only, avoiding external HTTP lookups to log aggregators.
SKILL.md
Loading
Related Openclaw Skills
buffy-agent
A free personal behavior agent for tracking habits, tasks, and routines with automated reminders and daily briefings across multiple chat platforms.
HTML Daily Report Generator Spec
A standardized HTML and CSS framework for AI agents to generate structured, masonry-style daily reports with built-in theme switching.
Romania
A specialized AI agent skill for planning deep, authentic Romanian travel experiences with regional expertise and practical logistics.
AI.MD: AI-Native Structured Instructions
AI.MD is a methodology and conversion tool that transforms human-readable system instructions into high-precision, structured labels optimized for LLM attention and token efficiency.
India Travel Assistant
A comprehensive travel intelligence agent designed to navigate the complexities of Indian geography, culture, and logistics for every type of traveler.
Stock Technical Analysis
A lightweight Python-based utility for calculating key technical indicators and trading signals using Yahoo Finance data.
Featured*
