amass enum

amass enum -d <domain>

OWASP tool for subdomain enumeration using multiple OSINT sources and active techniques.

During extensive reconnaissance phase, when you need the most complete list of subdomains possible. Amass combines search engine scraping, SSL certificates, historical DNS, and more. In an engagement where budget and time allow, it is the go-to tool for mapping the attack surface.

If you only need a few subdomains, it is overkill. Also, do not use it if you do not have a good internet connection or if the Shodan/Virustotal API is not configured; much of its power comes from third-party integrations.