The short answer: you need to enumerate your subdomains from multiple passive and active sources, then scan each discovered host for open ports and running services. Doing this manually is tedious and incomplete — modern teams use automated attack surface management tools that continuously repeat the process so new exposure is caught the moment it appears. Below is a practical guide to both approaches.
Every subdomain you have ever spun up — staging environments, old marketing microsites, internal dashboards accidentally published — is a potential entry point for an attacker. Open ports tell attackers which services are listening, what software versions are running, and which CVEs might apply. Most breaches don't go through the front door; they go through a forgotten dev.yourdomain.com running an unpatched version of a framework no one remembers deploying.
If you want to understand the underlying mechanics before automating them, here is what security researchers do manually:
crt.sh index every TLS certificate ever issued. Searching your apex domain reveals subdomains that have had certificates, including ones that may still be live.dnsx, massdns, or shuffleDNS try thousands of common subdomain prefixes against your domain's DNS and record which ones resolve.site:yourdomain.com surface indexed subdomains and pages that may not be linked from your main site.nmap -sV -p- <host> to enumerate open ports and grab service banners. The -sV flag attempts version detection, which is critical for CVE matching.httpx visit every discovered host on common web ports and confirm which ones serve HTTP/HTTPS responses, capturing titles, status codes, and technology fingerprints.The problem with doing all of this manually is that it is a snapshot. By the time you finish, your infrastructure has probably changed.
Raw subdomain and port lists are noisy. Here is how to triage what you find:
Attack surface is not static. Engineers push new services daily, certificates are issued for test environments, cloud assets get spun up and never torn down. A one-time scan gives you a false sense of security. What you actually need is a system that re-runs the full recon pipeline every few hours and alerts you the moment something new appears — before an adversary finds it first.
yourdomain.com is probably well-hardened. The risk lives in old-staging.yourdomain.com.Pinaka is an AI-powered External Attack Surface Management platform that automates the entire recon pipeline described above — and then goes further by having an adversarial AI agent hunt the findings the way a real attacker would.
Here is what Pinaka does out of the box:
Pinaka integrates directly into tools like Claude and Cursor via MCP, so your security recon runs without context switching. You can also run a free security check on your domain in under a minute with no signup required — visit pinaka.sh to try it.
Pinaka's findings are deterministic and reproducible. Every hunt records exactly what it tested, what it found, and what it ruled out — so you verify the work rather than trust it on faith. No inflated critical findings, no noise to wade through.
Passive enumeration queries third-party data sources — certificate transparency logs, passive DNS databases, search engine indexes — without sending any traffic to the target. Active enumeration sends DNS queries or HTTP probes directly to the target's infrastructure. Passive is stealthier; active is more complete. Production-grade tools like Pinaka use both in combination.
Yes — scanning infrastructure you own or have explicit written permission to test is legal in most jurisdictions. You should never scan domains you do not own or have permission to test, as unauthorised scanning can violate computer fraud laws regardless of intent.
Cloud-native organisations should run it continuously — at minimum every few hours. Infrastructure changes (new deployments, certificate issuance, DNS updates) happen daily. A weekly or monthly scan leaves large windows of undetected exposure. Pinaka's Watchdog monitoring re-scans every 6 hours automatically.
Subdomain takeover occurs when a DNS record (usually a CNAME) points to a third-party service (GitHub Pages, Heroku, AWS S3, etc.) that has been deleted or released. An attacker can register that service and begin serving content under your subdomain. Detection requires checking each discovered subdomain against known takeover-vulnerable service fingerprints — Pinaka includes this as part of its cloud asset discovery module.
Not with modern platforms. Tools like Pinaka are designed to surface prioritised, actionable findings rather than raw technical output. The AI-powered scoring tells you what to fix first without requiring you to manually triage hundreds of open ports or CVE IDs. That said, understanding the fundamentals — as covered in this guide — helps you interpret results and have informed conversations with your engineering team.