Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint
Under maintenancePricing
Pay per usage
Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint
Under maintenanceMap a domain's external attack surface. Passive subdomain enumeration with subfinder, HTTP fingerprint with httpx: status, title, server, technology stack, TLS issuer and IP. One dataset row per responding host. For recon, asset discovery and security audits.
Pricing
Pay per usage
Rating
0.0
(0)
Developer
Sevastian Z
Maintained by CommunityActor stats
0
Bookmarked
1
Total users
0
Monthly active users
3 days ago
Last modified
Categories
Share
Map a domain's external attack surface in one run. Pass a registrable domain, get back every subdomain that responds on HTTP/S, fingerprinted: status code, title, server header, detected technology stack, TLS issuer, IP.
Built on the Project Discovery toolchain (subfinder + httpx). Wrapped for
people who do not want to install Go binaries to run a recon scan.
What it does
- Passive subdomain enumeration with
subfinder. Queries public sources (Certificate Transparency, CommonCrawl, DNS dumps, search engines). No DNS brute force, no scraping of the target. - HTTP fingerprint with
httpx. For each discovered host, follow redirects and capture: status code, page title, Server header, detected technologies (Wappalyzer-style), TLS certificate issuer and validity, IP. - One row per responding host in the dataset. Easy to filter, export or feed into a vulnerability scanner.
Input
| Field | Type | Description |
|---|---|---|
domain | string, required | Registrable domain, e.g. example.com |
Output
| Field | Description |
|---|---|
host | discovered hostname |
url | final URL after redirects |
status_code | HTTP status |
title | HTML title element |
webserver | Server response header |
tech | detected technology stack (Wappalyzer signatures) |
ip | resolved IP |
tls_issuer | TLS certificate issuer organization |
tls_subject_cn | TLS certificate subject CN |
tls_not_after | TLS certificate expiry |
content_length | response body length |
Pricing
Free. You pay only the standard Apify platform usage (compute) for your own runs.
Use cases
- External asset discovery and inventory.
- Pre-engagement recon for pentesting and bug bounty.
- Continuous attack-surface monitoring (run on a schedule).
- Mergers / acquisitions due diligence on a target's exposed surface.
Related: catch impersonation, not just exposure
This actor maps your own surface. Attackers also register lookalike and typosquatted domains to impersonate brands. To detect those, scan with Lookalike / Typosquat Domain Scan and use the free Certificate Transparency Subdomain Search.
Notes
Probing is HTTP/S only, with rate limiting. No port scanning, no exploitation. Run against domains you are authorized to test.
