---
name: "sublist3r-subdomain-enumerator"
description: "Discover public subdomains across internet search engines and SSL certificate logs."
metadata:
  author: "Ahmed Aboul-Ela"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "enumerate subdomains sublist3r"
  - "find subdomains with osint"
  - "discover external attack surface"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Sublist3r OSINT Subdomain Enumeration Tool

Gathers public subdomains using Sublist3r: querying multiple search engines (Google, Yahoo, Bing, Baidu), Netcraft, Virustotal, and crt.sh SSL/TLS certificate transparency logs.

## When to Invoke
Invoke this skill whenever you need to:
- enumerate subdomains sublist3r
- find subdomains with osint
- discover external attack surface

## Execution SOP & Rules
1. Run sublist3r -d example.com -o subdomains.txt to collect discovered hostnames.
2. Enumerate certificate transparency logs to uncover recently issued subdomain certificates.
3. Verify whether discovered subdomains resolve to active IP addresses or dangling DNS records.
4. Decommission or firewall forgotten test and staging environments.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.