Bug › Module 4 › Lesson 2
Subdomains In Scope
Subdomain discovery maps attack surface — enumerate only subdomains confirmed in-scope for $SCOPE_HOST.
Visual · bounty_subdomains_in_scope
Subdomains in-scope only. $SCOPE_HOST only. Original Cyberlium.
Opening
Every subdomain is not yours to scan. Scope decides — not the tool output.
Subdomain enumeration combines passive sources (CT logs, DNS datasets) and active techniques (brute force, permutations) — all results must be filtered against program in/out lists before probing. Wildcard scope rules (*.example.com) still have exclusions. Out-of-scope subdomains get noted, not scanned. Cyberlium teaches subdomain literacy against $SCOPE_HOST only. You will NOT run amass on classmate domains or brute force café subdomains because tools make it easy. Next: URL Discovery Literacy.
1. Discover, then filter against scope
Workflow: passive subdomain sources → candidate list → in-scope checklist per hostname → active probe only on confirmed in-scope hosts tied to $SCOPE_HOST program.
Tools name hosts; scope decides permission. A discovered staging.dev.$SCOPE_HOST still needs policy confirmation.
Command guide
Try these commands — Discover, then filter against scope
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Subfinder — enumerate subdomains in YOUR scope Rate limit — head -20 on all recon
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
macOS:
Command — copy this
brew install subfinder brew install httpx
Windows:
Command — copy this
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t20-scope.env" subfinder -d "$(cat "$HOME/cyberlium-lab/t20-root-domain.txt" 2>/dev/null || echo httpbin.org)" -silent 2>/dev/null | head -20 > "$HOME/cyberlium-lab/t20-hosts.txt" || printf '%s ' "$SCOPE_HOST" > "$HOME/cyberlium-lab/t20-hosts.txt" wc -l "$HOME/cyberlium-lab/t20-hosts.txt"
Primary tools to practice this lesson: subfinder, httpx. Reference sites: Subfinder; Rate limit. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Wildcard and exclusion literacy
Programs may say *.example.com in scope EXCEPT mail.example.com, status.thirdparty.com. Read exclusions before brute force. Rate limits apply to subdomain tools too.
Copy-pasting tutorial subdomain lists against random domains violates Cyberlium ethics — filter to $SCOPE_HOST.
3. Subdomain tourism is out
Students sometimes enumerate dorm hostnames or classmate deploy subdomains because tools make it easy. That is out of scope and often unauthorized.
Ship: subdomain workflow — discover → filter → probe, with $SCOPE_HOST as root. Next: URL Discovery Literacy.
4. What you ship: subdomain filter workflow for $SCOPE_HOST
Discover → in-scope filter → probe. Wildcard/exclusion notes. $SCOPE_HOST root only. chmod 600.
5. What you record before the next lesson
Date. Subdomain workflow. $SCOPE_HOST root named. File t20-m04-l02-subdomains-in-scope.txt chmod 600.
6. Wrong vs right: random sites vs in-scope program
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Brute force all subdomains on any domain. Probe out-of-scope staging because 'interesting.'
Right
Write subdomain filter workflow for $SCOPE_HOST. Next: URL Discovery Literacy.
Mission: template subdomain filter workflow
1) Write discover → filter → probe steps. 2) Note wildcard rules for $SCOPE_HOST. 3) chmod 600. Never probe unfiltered subdomain lists.
Stuck? Ask Cyberlium AI Mentor
Tool output is hints — scope is permission.
Knowledge Check
APPLY: After subdomain enumeration on $SCOPE_HOST you:
Multiple choice
Knowledge Check
APPLY: True or False: *.domain in scope means every subdomain is always authorized.
True or False
Knowledge Check
APPLY: Subdomain brute force on classmate deploy is:
Multiple choice