sublist3r

sublist3r -d <domain>

OSINT tool for enumerating subdomains using search engines, Netcraft, VirusTotal, and more.

When you need quick and lightweight subdomain enumeration without the overhead of Amass. Sublist3r is my go-to for a 5-minute scan that gives you a solid starting point. Ideal in the early stages of a pentest when time is limited.

If the domain is very large or you have IP restrictions (rate-limiting), because it queries multiple sources in parallel. In environments with a restrictive proxy, it may fail.