How to: Subdomain Enumeration
https://web.archive.org/web/20211127183642/https://appsecco.com/books/subdomain-enumeration/
# This book intendes to be a reference for subdomain enumeration techniques.

https://celes.in/posts/cloudflare_ns_whois
# Enumerating all domains from a cloudflare account by nameserver correlation.

https://pugrecon.com/
# Query some subdomains!

https://github.com/knownsec/ksubdomain
# ksubdomain是一款基于无状态子域名爆破工具，支持在Windows/Linux/Mac上使用，它会很快的进行DNS爆破，在Mac和Windows上理论最大发包速度在30w/s,linux上为160w/s的速度。
```ksubdomain -d example.com```

https://github.com/OWASP/Amass
# The OWASP Amass Project performs network mapping of attack surfaces and external asset discovery using open source information gathering and active reconnaissance techniques.
```amass enum -passive -dir /tmp/amass_output/ -d example.com -o dir/example.com```

https://github.com/projectdiscovery/subfinder
# subfinder is a subdomain discovery tool that discovers valid subdomains for websites by using passive online sources.
```subfinder -r 8.8.8.8,8.8.4.4,1.1.1.1,1.0.0.1 -t 10 -v -d example.com -o dir/example.com```

https://github.com/infosec-au/altdns
# Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of.
```altdns -i subdomains.txt -o data_output -w words.txt -r -s results_output.txt```

https://github.com/Josue87/gotator
# Gotator is a tool to generate DNS wordlists through permutations.
```gotator -sub domains.txt -perm permutations.txt -depth 2 -numbers 5 > output.txt```

https://github.com/nsonaniya2010/SubDomainizer
# SubDomainizer is a tool designed to find hidden subdomains and secrets present is either webpage, Github, and external javascripts present in the given URL.
```python3 SubDomainizer.py -u example.com -o dir/example.com```

https://github.com/projectdiscovery/uncover
# uncover is a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet.

https://dns.bufferover.run/dns?q=example.com
# Powered by DNSGrep (https://github.com/erbbysam/DNSGrep)
# A utility for quickly searching presorted DNS names. Built around the Rapid7 rdns & fdns dataset.

https://crt.sh/?q=example.com
# Certificate Search

https://censys.io/certificates?q=parsed.subject_dn%3AO%3DExample+Organization
# Censys is the most reputable, exhaustive, and up-to-date source of Internet scan data in the world, so you see everything.

https://www.shodan.io/search?query=ssl%3AExample
# Shodan is the world's first search engine for Internet-connected devices.

https://profundis.io/
# Profundis is a search engine which focuses on indexing hosts, DNS records, certificates, etc rather than web pages. You may use it to discover new assets or get alerts when a new host which matches specific criteria is discovered.

https://fullhunt.io/
# If you don't know all your internet-facing assets, which ones are vulnerable, FullHunt is here for you.

https://github.com/xiecat/fofax
# fofax is a fofa query tool written in go, positioned as a command-line tool and characterized by simplicity and speed.
```fofax -q 'app="APACHE-Solr"'```

https://publicwww.com
# Find any alphanumeric snippet, signature or keyword in the web pages HTML, JS and CSS code.

https://en.fofa.info
# FOFA is a search engine for global cyberspace mapping belonging to Beijing Huashun Xin'an Technology Co., Ltd.
# Through continuous active detection of global Internet assets, more than 4 billion assets and more than 350,000 fingerprint rules have been accumulated, identifying most software and hardware network assets. Asset data supports external presentation and application in various ways and can perform hierarchical portraits of assets based on IP.

https://getodin.com/
# ODIN is a powerful internet scanning tool that empowers users with real-time threat detection, comprehensive vulnerability assessment, and smart, fast, and free capabilities, making it a versatile solution for enhancing cybersecurity.

https://www.zoomeye.org
# ZoomEyeis China's first and world-renowned cyberspace search engine driven by 404 Laboratory of Knownsec. Through a large number of global surveying and mapping nodes, according to the global IPv4, IPv6 address and website domain name databases，it can continuously scan and identify multiple service port and protocols 24 hours a day, and finally map the whole or local cyberspace.

https://securitytrails.com/list/email/dns-admin.example.com
# Total Internet Inventory with the most comprehensive data that informs with unrivaled accuracy.
```curl --request POST --url 'https://api.securitytrails.com/v1/domains/list?apikey={API_Key}&page=1&scroll=true' --data '{"filter":{"apex_domain":"example.com"}}' | jq -Mr '.records[].hostname' >> subd