Glossary
What Is Subdomain Enumeration?
Subdomain enumeration is the discovery of all the subdomains beneath a domain — mail, vpn, staging, dev — to map an organisation's external footprint. Passive enumeration finds them from data the internet already exposes (the DNS hierarchy, Certificate Transparency logs, passive DNS) without sending a single packet to the target.
How Whisper models it
The DNS hierarchy is a CHILD_OF tree, so a parent’s subdomains are one reverse traversal — no scanning.
MATCH (s:HOSTNAME)-[:CHILD_OF]->(:HOSTNAME {name:"atlassian.com"}) RETURN s.name LIMIT 15Passive vs active enumeration
Active enumeration brute-forces or scans the target to find live subdomains, which is noisy and touches the target's infrastructure. Passive enumeration reads subdomains from data already published elsewhere — so the target never sees you looking. For mapping an attack surface from the outside, passive is the safe default.
Where passive subdomains come from
Two sources dominate. The DNS hierarchy: every subdomain is a child of its parent domain, so walking the parent's children lists them. And Certificate Transparency: every TLS certificate is logged publicly with its subject-alternative names, so subdomains that ever got a certificate appear in CT — including internal-looking hosts that were never meant to be found.
Why it matters
The forgotten staging server, the test subdomain still pointing at a decommissioned host, the admin panel on a guessable name — these are the shadow infrastructure attackers look for first. Enumerating them is the first step in attack-surface mapping. Treat the result as a floor, not a complete inventory: passive data shows you at least this much.
See it in practice
Run it live in these use cases: Map an org's whole attack surface.