Refer to Simple WebPentest Checklist Subdomain Enumeration git clone https://github.com/TheRook/subbrute.git python subbrute.py domain.com > subdomains.txt git clone https://github.com/infosec-au/altdns.git altdns -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt #paste the list into Bulk URL HTTP Status Code, Header & Redirect Checker | httpstatus.io # this will give live hosts status make sure to check subdomain of the sub-domains #Other Tools amass enum -passive -norecursive -noalts –df domin.txt -o subs-1.txt amass enum -passive -norecursive -noalts –df subs-1.txt -o all-sub.txt Fetching URLS for a domain #Use GAU to get all urls download from https://github.com/lc/gau/releases or go install github.com/lc/gau/v2/cmd/gau@latest printf example.com | gau cat domains.txt | gau --threads 5 gau example.com google.com gau --o example-urls.txt example.com gau --blacklist png,jpg,gif example.com Recon Automation #Better use https://github....
Way to Divergence