Ever wondered how experienced bug hunters seem to find dozens of forgotten subdomains a target didn’t even know were still online? Subdomain enumeration for beginners sounds like it needs expensive tools or years of practice, but the honest version fits in a single terminal session with free software. This post builds that first pipeline from scratch.