Subdomain Enumeration for Bug Bounty: A Practical Recon Guide
Most bounty surface is not the marketing homepage. Staging hosts, legacy apps, and forgotten dev- subdomains pay. Subdomain enumeration is how you find them — quietly and inside scope.
Passive first (usually safest)
- Certificate transparency logs
- Public DNS datasets and search engines
- The program’s own scope file / asset inventory
- JavaScript and mobile apps referencing API hosts
- Historical HTTP datasets when policy allows
Collect candidates, then filter strictly to in-scope patterns (*.example.com vs explicit list).
Light active checks
Only when the program allows:
- DNS resolution of discovered names
- HTTP/HTTPS probes for titles and status codes
- Screenshot or tech fingerprint for prioritization
Avoid aggressive brute force against infrastructure that is out of scope or rate-limited in the rules.
What to prioritize
- Hosts with login forms
- Different TLS certs or stale titles (“Jenkins”, “Grafana”, “phpMyAdmin”)
- CNAMEs pointing at third-party SaaS (takeover candidates)
- Dev/staging that shares production SSO
Link to other hunts
Enumeration feeds subdomain takeover testing, vhost discovery, and older stack XSS. Keep a spreadsheet: subdomain → tech → notes → tested.
Report hygiene
Finding a subdomain alone is rarely a vulnerability. Report the security issue on it (auth bypass, takeover, exposed panel) and mention how you discovered the host.
Defensive checklist
- Maintain an inventory of DNS names and owners.
- Alert on new public certificate issuances for your domains.
- Tear down unused CNAMEs quickly.
- Put staging behind VPN or SSO, not the public internet.
Recon is leverage. Enumerate patiently, filter by scope, and spend deep testing time where the forgotten hosts live.
Original Bugflare guide informed by OWASP information-gathering practices for web testing.