5 ways subdomain enumeration breaks (and how to handle each)

Subdomain enumeration looks easy. There's a wordlist. There are CT logs. There's a DNS resolver. Plug them together, return a list. Maybe sort it. Then you run it on 50 different domains for the first