1) Subdomain enumeration

• [x] Subdog
• [x] Subfinder
• [x] Assetfinder
• [x] crt.sh
• [x] Subdomain Finder – C99.nl

2) DNS resolution

• [x] dnsx

3) Port scanning

• [x] Naabu

4) HTTP probing + fingerprinting

• [x] httpx
• [x] Techfinder

5) URL crawling / endpoint discovery

• [x] Wayback URLs