Reconnaissance

Subdomain Discovery

subfinder performs passive subdomain enumeration by querying multiple public sources (Certificate Transparency logs, DNS datasets, search engines). It discovers subdomains without sending any traffic to the target.

subfinder -d <domain> -silent -timeout 60

dig +short <subdomain>

dig resolves each subdomain to its IP address. Only the first A-record IP is stored. Resolution failures result in an empty IP field.

Port Scanning

nmap performs host discovery to find additional subdomains and verify which hosts are alive.

nmap -sn --open -T4 --max-retries 1 <domain>

nmap output is parsed for "Nmap scan report for" lines. Hostnames are extracted and deduplicated against subfinder results. IP addresses are captured from parenthesized notation (e.g., "host.example.com (192.168.1.1)").

HTTP Service Discovery

httpx-pd probes all discovered subdomains and the root domain for live HTTP services. It collects response status codes, page titles, and technology fingerprints.

httpx-pd -silent -status-code -title \
  -tech-detect -follow-redirects \
  -timeout 15 -retries 1

Output lines are parsed to extract URLs and status codes. Lines matching (https?://[^\s]+) [(\d+)] are captured with their status code. HTTP methods default to GET.

Data Correlation

Results from all tools are correlated into a unified data model. Subdomains discovered by subfinder and nmap are merged and deduplicated by name. Each subdomain is mapped to its resolved IP address, discovered endpoints, and identified technologies.

Stored Results

Reconnaissance results are stored in two database tables:

subdomains table

subdomains
  ├── id          UUID (primary key)
  ├── scan_id     UUID (foreign key to scans)
  ├── name        TEXT (e.g., "api.example.com")
  ├── ip_address  TEXT (e.g., "192.168.1.1")
  └── status      TEXT ("active")

endpoints table

endpoints
  ├── id          UUID (primary key)
  ├── scan_id     UUID (foreign key to scans)
  ├── url         TEXT (e.g., "https://api.example.com/health")
  ├── method      TEXT (e.g., "GET")
  └── status_code INTEGER (e.g., 200)

Installed Tools

The following tools are installed on the XnoleX scanning infrastructure: