AOXSIN

Taking our target root domain (for Bug Bounty / Responsible Disclosure) such as deepseek[.]com, we will want to feed it into DNS Discovery tools, those divide to 2 main workflows - Passive & Active. In the passive sense, we want to query public DNS datasets all over the internet and collect known subdomains of our target, the best way to do that is using a tool such as subfinder by @pdiscoveryio In the active sense, we will collect public wordlists with hundreds of thousands of domain names, and will try to fuzz and "guess" additional valid domains under our target - deepseek[.]com, such as "admin.deepseek[.].com" etc,etc... For this task, a tool I recommend is Puredns github.com/d3mondev/puredns Which is simply run by the following command: Additionally, there are more techniques such as permutation (adding dev-admin.deepseek[.]com for example) but we will leave it like that. The goal of this phase is to collect a list of valid subdomains, and save them all in a single place. Valid subdomain in our sense - a DNS record that has an IP Address or points to another asset.