> For the complete documentation index, see [llms.txt](https://red.infiltr8.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://red.infiltr8.io/redteam/recon/subdomains-enumeration.md).

# Subdomains enumeration

When conducting penetration tests on a website, or on a `*.domain.com` scope, finding subdomains of the target can help widen the attack surface. There are many different techniques to find subdomains that can be divided in two main categories.

{% content-ref url="/pages/9SBVBz7fKr5cKG5EX995" %}
[Subdomains enumeration](/web-pentesting/recon/subdomain-enum.md)
{% endcontent-ref %}