Subdomains

Enumeration

Dorks

Google

site:*.wikipedia.org -www -store -jobs -uk

site:*.*.example.com
site:*.*.*.example.com 

Tools

# wfuzz
wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u "http://$target.com" -H "Host: FUZZ.$target.com"

# ffuf
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.target.com" -u $target.com

# amass
amass enum -d $domain

# sublistr |
sublist3r -d $domain -v

# dnsrecon
dnsrecon -t brt -D /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -v -d $domain

# dnsenum
dnsenum $target.com

Online Tools

https://dnsdumpster.com/dnsdumpster.com

DNS and host enumeration

VirusTotalVirusTotal

VirusTotal Search

Takeover

A Guide To Subdomain TakeoversHacker0x01

Subjack

GitHub - haccer/subjack: Subdomain Takeover tool written in GoGitHub

./subjack -w subdomains.txt -t 100 -timeout 30 -o results.txt -ssl