Skip to main content

​
Subdomain Enumeration

Every audit begins by enumerating the target’s subdomains. Golem AI uses passive OSINT only — no DNS brute-force, no traffic to the target during enumeration. This keeps the engagement quiet and minimizes false positives.

​
The seven sources

Golem queries all of these in parallel and merges results: Each source contributes a partial view. Combining them produces the most complete passive subdomain set practically obtainable.

​
Validation

Raw OSINT results contain noise — expired DNS, typos, decommissioned subdomains. Golem validates every candidate:
  1. DNS resolution — does the subdomain still resolve?
  2. Liveness — is anything answering on common ports (80, 443, plus discovered ones)?
  3. HTTP response — does the live host respond meaningfully (not 404 from a default page)?
  4. Stack fingerprinting — what is it (so later phases can target appropriately)?
Subdomains that pass validation become the working target set for phases 3+.

​
Targeting the right scope

By default, enumeration is scoped to the workspace’s primary domain and any explicit subdomains you pass in targets.
Golem will enumerate subdomains under whatever apex domain it can derive from the targets. If you want to restrict scope strictly to the targets you pass, say so in Autonomous mode:

​
What you’ll see in the report

The audit report includes an Attack Surface section listing every subdomain discovered, marked as in-scope or out-of-scope, with the source that surfaced each one. This serves as both:
  • Evidence of enumeration coverage
  • A starting point for the next engagement

​
Targets that don’t show up

Passive OSINT will miss:
  • Internal-only subdomains that never appear in CT logs or public scans
  • Subdomains created very recently (under a few hours old)
  • Subdomains intentionally excluded from public DNS
If you need to test internal subdomains or pre-launch infrastructure, pass them explicitly in targets.

​
Programmatic access

You can run subdomain enumeration as a standalone operation, separate from a full audit:
See the Subdomains API reference for details.