Automatically discover hidden subdomains for security testing

flowchart TD trig(("you upload authorized domains")):::human s0["submit authorized domain list"]:::task s1["combine results from data sources"]:::task s2["ai generates additional candidates"]:::task s3[["validate and test each candidate"]]:::mi s4["return live subdomain list"]:::task trig --> s0 s1 --> s2 s2 -->|"one per each candidate subdomain"| s3 s3 --> s4 gx{"+ which sources to query"}:::gate s0 --> gx p00["query source"]:::task gx -->|"public source lookup"| p00 p10["query source"]:::task gx -->|"passive source lookup"| p10 jn{"+ combine source results"}:::gate p00 --> jn p10 --> jn jn --> s1 out[/"verified live subdomain list"/]:::out pay{{"full authorized attack surface visibility"}}:::pay s4 --> out out --> pay classDef task fill:#e7f6fe,stroke:#34b8f0,color:#2c2a29 classDef svc fill:#f6f8fa,stroke:#7c8795,color:#2c2a29 classDef mi fill:#e7f6fe,stroke:#0079a8,color:#2c2a29,stroke-width:2px classDef human fill:#fff,stroke:#0079a8,color:#0079a8 classDef store fill:#f6f8fa,stroke:#0079a8,color:#2c2a29 classDef trig fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigtime fill:#00a4eb,stroke:#0079a8,color:#fff,font-weight:bold classDef trigdata fill:#8ad4f5,stroke:#0079a8,color:#06314c,font-weight:bold classDef gate fill:#fff,stroke:#e8a23d,color:#6b4708,font-weight:bold classDef out fill:#1f9d6b,stroke:#167a53,color:#fff,font-weight:bold classDef pay fill:#06314c,stroke:#021f33,color:#fff