subdomain-enumeration

仓库创建 2026年7月26日最近提交 18 小时前SkillHot 收录 4 小时前

▸ 精选理由

为后续 Web/API/云测试提供去重的活跃子域列表，提升侦察效率。

▸ 风险提示

可被用于未授权扫描与渗透，使用时需遵守法律与授权范围

这个 Skill 做什么

枚举目标组织的子域以发现隐藏主机和服务，作为后续渗透测试起点。

想把目标的隐藏主机、老后台和测试环境找出来时用，帮你收集并去重目标组织的子域清单并验证哪些能连通。是渗透测试和侦察的第一步，结果会喂给后续的 web、API 和 cloud 测试。它强调只列出“会回应”的活跃主机，避免把无用条目带进后续工作流。

▸ 展开 SKILL.md 英文原文

Use when you need to map an organisation's subdomains to find hosts and services outside the obvious www — the first recon step that feeds web, API, and cloud testing.

垂直行业子域枚举OSINT侦察通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/01-osint-and-reconnaissance/01-subdomain-enumeration/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/01-osint-and-reconnaissance/01-subdomain-enumeration/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

Organisations expose far more than their main site. Staging boxes, old admin panels, forgotten marketing microsites, dev APIs — they all live on subdomains, and the neglected ones are usually the soft spot. This skill gets you a deduplicated, live list of an org's subdomains so the rest of your recon has somewhere to point.

It stops at "here are the hosts that answer." Fingerprinting and vulnerability testing are separate skills.

## When to use it

At the start of almost any external assessment, right after you've confirmed the root domains are in scope. Also useful for continuous monitoring — running it weekly surfaces new hosts as an org ships them.

Skip it if you were hande

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有