In this repo, I have created a subdomain enumeration function that grab subdomains in deep.
Place this code into your .bashrc file and run source .bashrc. Now run subenum target.com
Installation:
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
Subfinder is a good tool if it used with all api keys.
Here is the writeup how to get api keys for subfinder to maximizing the output.
Maximizing the Potential of Subfinder
Installation:
go get -u github.com/tomnomnom/assetfinder
Installation:
GO111MODULE=on go get github.com/d3mondev/puredns/v2
Installation:
git clone https://github.com/blechschmidt/massdns.git
cd massdns
make
sudo make install
Installation:
pip3 install dnsgen
Installation:
go install github.com/Josue87/gotator@latest
Installation:
go install -v github.com/OWASP/Amass/v3/...@master
Installation:
git clone https://github.com/UnaPibaGeek/ctfr.git
cd ctfr
pip3 install -r requirements.txt