{"uid":"cap_fLU8EHuBUMjAVqSBMH_PD","slug":"subdomain-enumeration-via-public-sources-d4b418e2","name":"Subdomain Enumeration via Public Sources","description":"Passive subdomain enumeration for a domain via public sources (subfinder).","url":"https://k2so.wrong.systems/api/services/subdomain-enumeration","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"meta":{"enum":["0","1"],"type":"string","description":"Set to 1 for free metadata JSON (no payment required)"},"domain":{"type":"string","description":"Composite input parameter"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","title":"Subdomain Enumeration paid response","$schema":"https://json-schema.org/draft/2020-12/schema","required":["ok","paid","service","provider","result"],"properties":{"ok":{"type":"boolean"},"paid":{"type":"boolean"},"result":{"type":"object","required":["ok","service"],"properties":{"ok":{"type":"boolean","description":"Handler success"},"score":{"type":"number"},"service":{"type":"string","description":"Service slug"},"summary":{"type":"string"},"evidence":{"type":"object"},"strengths":{"type":"array","items":{"type":"string"}},"confidence":{"type":"string"},"generatedAt":{"type":"string","description":"ISO-8601 timestamp"},"riskFactors":{"type":"array","items":{"type":"string"}}}},"payment":{"type":"object","properties":{"code":{"type":"string"},"payer":{"type":"string"},"detail":{"type":"string"},"selfPay":{"type":"boolean"},"transaction":{"type":"string"}}},"service":{"type":"string"},"provider":{"type":"string","const":"K-2SO"}}}}}}},"responseSchema":{"type":"json","example":{"ok":true,"paid":true,"result":{"ok":true,"service":"subdomain-enumeration"},"service":"subdomain-enumeration","provider":"K-2SO"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.03","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"down","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.03/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.03","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_P1ythE4q41dc_pzcEBx3D","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.03","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Passively enumerates subdomains for a given domain using public OSINT sources via subfinder.","exampleAgentPrompt":"Can you find all the subdomains for acme-corp.com using passive public sources — I want to see what's exposed without doing any active scanning?","exampleUseCases":[{"title":"Attack surface mapping for security audit","prompt":"I'm doing a security assessment on targetcompany.com — can you passively enumerate all its subdomains using public OSINT so I can see the full attack surface before I start?"},{"title":"Competitor infrastructure reconnaissance","prompt":"I want to understand what subdomains competitor.io has publicly exposed — can you pull a list of all their subdomains from public sources?"},{"title":"Pre-pentest subdomain discovery","prompt":"Before I start my pentest on client-domain.net, run passive subdomain enumeration on it so I have a full picture of their external footprint without touching their servers."}],"resultDescription":"A JSON response containing a list of discovered subdomains for the queried domain, sourced passively from public data (e.g. certificate transparency logs, DNS records, search engines). Includes ok/paid status flags, service/provider metadata, and the enumerated subdomain results.","failureModes":["Domain not found or no results available — returns empty result set","Invalid domain format — query rejected","Payment not completed — 402 response requiring USDC payment","Rate limiting or upstream source unavailability — partial results or timeout","Private/unlisted domains with no public footprint — zero subdomains returned"],"whenToPreferThis":"Use this endpoint when you need passive, non-intrusive subdomain discovery using aggregated public OSINT sources (certificate transparency, DNS, search engines) without touching the target's infrastructure. Prefer over active scanners when stealth is required or active probing is restricted. Best suited for security assessments, attack surface mapping, and recon workflows that must avoid generating traffic on the target network.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T20:25:22.132Z","isFirstParty":false}