Typorithm · medium

Active Enumeration

active-enumpentestsubdomaindnsdiscovery

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Active Enumeration

Recon & OSINT

Active enumeration sends real packets to the in-scope target: subdomain brute force (gobuster), mass DNS resolution (dnsx), active probing (amass -active), and host discovery (nmap -sn). It is noisier and detectable, so it stays strictly within the authorized scope; the goal is to map live hosts and resolvable subdomains.

Active recon contacts the target directly, so every query is logged on the target side and may trip intrusion detection. Run it only against assets explicitly listed in the engagement scope.

Subdomain brute force (gobuster dns) and active resolution (amass -active, dnsx) confirm which hostnames really exist by sending DNS queries, turning the passive candidate list into a verified one.

Host discovery with nmap -sn sweeps an authorized network range to find which hosts are alive before any port or service scanning. Together these steps produce a map of live hosts and resolvable subdomains to test next.

Active recon sends packets — detectable and logged.

gobuster/dnsx confirm subdomains via real DNS queries.

nmap -sn discovers live hosts without port scanning.

amass enum -active -d target.com
gobuster dns -d target.com -w wordlist.txt
dnsx -d target.com -w subdomains.txt
nmap -sn 10.0.0.0/24

Read the implementation

Connect each part of the code to the concept before you type.

1. Active subdomains

amass -active resolves and probes candidate hosts directly, sending real DNS and HTTP requests to the in-scope target.

amass enum -active -d target.com

2. DNS brute force

gobuster dns guesses subdomains from a wordlist, issuing one DNS query per candidate — noisy and detectable.

gobuster dns -d target.com -w wordlist.txt

3. DNS resolution

dnsx mass-resolves a subdomain list to confirm which names actually point to live records.

dnsx -d target.com -w subdomains.txt

4. Host discovery

nmap -sn is a ping sweep of the authorized /24 range — it finds live hosts without scanning ports.

nmap -sn 10.0.0.0/24

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.