https://github.com/aboul3la/Sublist3r https://github.com/jhaddix/domain https://github.com/guelfoweb/knock https://github.com/TheRook/subbrute https://github.com/blechschmidt/massdns https://bitbucket.org/LaNMaSteR53/recon-ng https://github.com/caffix/amass https://github.com/cakinney/domained https://github.com/rbsec/dnscan
https://github.com/michenriksen/aquatone
https://tools.kali.org/information-gathering/dnsrecon
https://www.aldeid.com/wiki/Fierce
https://github.com/OJ/gobuster
https://github.com/fwaeytens/dnsenum
https://github.com/infosec-au/altdns
https://github.com/sensepost/BiLE-suite
https://github.com/tomsteele/blacksheepwall
https://github.com/RandomStorm/Bluto
https://github.com/anshumanbh/brutesubs
https://github.com/mandatoryprogrammer/cloudflare_enum
https://github.com/UnaPibaGeek/ctfr
https://github.com/m0nad/DNS-Discovery
https://github.com/lorenzog/dns-parallel-prober
https://github.com/evilsocket/dnssearch
https://github.com/mschwager/fierce
https://github.com/mhmdiaa/second-order
https://github.com/jrozner/sonar
https://github.com/laramies/theHarvester
https://github.com/gwen001/vhost-brute
https://github.com/codingo/VHostScan
https://github.com/jobertabma/virtual-host-discovery
https://github.com/ChrisTruncer/EyeWitness
https://github.com/sharsi1/sublazerwlst
https://github.com/appsecco/the-art-of-subdomain-enumeration
https://github.com/evilsocket/xray
https://www.nlnetlabs.nl/projects/ldns/
https://dnscurve.org/nsec3walker.html
https://github.com/eldraco/domain_analyzer
https://github.com/christophetd/censys-subdomain-finder
https://github.com/n4xh4ck5/N4xD0rk
https://github.com/n4xh4ck5/V1D0m
Online DNS tools
http://searchdns.netcraft.com/
https://securitytrails.com/dns-trails
https://certspotter.com/api/v0/certs?domain=example.com
https://transparencyreport.google.com/https/certificates
https://developers.facebook.com/tools/ct
https://google.com/transparencyreport/https/ct/
https://www.certificate-transparency.org/known-logs
Subdomains bruteforce Wordlists:
https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056
https://github.com/danTaler/WordLists
https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS
https://room362.com/storage/saved/hugelist.txt
http://wordlist.aspell.net/other-dicts/
https://www.openwall.com/wordlists/