A penetration tester completed OSINT work and needs to identify common subdomains for mydomain.com. Which of the following is the best command for the tester to use?

The correct answer is D. cat wordlist.txt | xargs -n 1 -I 'X' host X.mydomain.com. Using dig with a wordlist to identify subdomains is an effective method for subdomain enumeration. The command cat wordlist.txt | xargs -n 1 -I 'X' dig X.mydomain.com reads each line from wordlist.txt and performs a DNS lookup for each potential subdomain.

Submitted by parkjh· Mar 6, 2026Reconnaissance and enumeration

Question

Options

Anslookup mydomain.com >> /path/to/results.txt
Bcrunch 1 2 | xargs -n 1 -I 'X' nslookup X.mydomain.com
Dcat wordlist.txt | xargs -n 1 -I 'X' host X.mydomain.com

How the community answered

(36 responses)

A
3% (1)
B
3% (1)
D
94% (34)

Explanation

Using dig with a wordlist to identify subdomains is an effective method for subdomain enumeration. The command cat wordlist.txt | xargs -n 1 -I 'X' dig X.mydomain.com reads each line from wordlist.txt and performs a DNS lookup for each potential subdomain.

Topics

#subdomain enumeration#OSINT#reconnaissance tools#DNS lookup

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice