small-recon for subdomains only

small-recon

#! /bin/bash
findomain -t $1 -q | tee $1.txt

subfinder -d $1 -silent | tee -a $1.txt

#crtsh

crtsh(){
curl -s https://crt.sh/?q\=%.$1\&output\=json | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u
}

crtsh $1 | tee -a $1.txt


dns(){
	curl -s https://dns.bufferover.run/dns?q=.$1 | jq  -r .FDNS_A[]|cut -d',' -f2|sort -u
}

dns $1 | tee -a $1.txt

cat $1.txt | sort -u | tee $1

rm -r $(pwd)/$1.txt