Overview

It’s organized by phase (enumeration → resolution → scanning → crawling → JS recon → wordlists → parameter discovery → fuzzing → dorking).

1) Subdomain enumeration

Subfinder

subfinder -d example.com -all -recursive -t 50 -timeout 30 -max-time 20 -silent | unew sub.txt

Subdog

echo "example.com" | subdog --all --silent | unew sub.txt

Assetfinder (example)

assetfinder --subs-only example.com | unew sub.txt

Online check (optional)

• Subdomain Finder - C99.nl

2) DNS resolution

dnsx

cat sub.txt | dnsx -silent -a -resp -o resolved.txt

3) Port scanning

naabu (top 1000 ports)

cat resolved.txt | awk '{print $1}' | naabu -silent -top-ports 1000 -o ports.txt