echo "example.com" | subdog --all --silent | unew sub.txt
subfinder -d example.com -all -recursive -t 100 -timeout 30 -max-time 30 -silent | unew subdomains.txt
**cat urls.txt | favinfo --timeout 15s --json > results.json**
Naabu quickly identifies open ports across discovered subdomains, helping uncover additional services and expand the attack surface before HTTP enumeration.
cat subs.txt | naabu -duc -silent -passive ( fast and uses shodan db , when we have less time use this )
add active scanning here
cat subs.txt | vyre --status-code --title --content-length --response-time ( faster than httpx, use this first to get alive ones and work on them first and run httpx after running vyre )
cat allsubs.txt | httpx -duc -silent -nc -sc -title -td -cl -ct | sort -t'[' -k3,3nr | unew -el -i httpx.txt
cat httpx.txt | awk '{print $1}' | dlevel --silent --max-level | unew -el -i alivesubs.txt
cat httpx.txt | grep -aEi 'IIS|fIIS Windows Server|Microsoft-IIS|Windows Server|3CX|phppgadmin|phpmyadmin|jetty|jboss|kibana|grafana|gitlab|kubernetes|citrix|symfony|jira|geoserver|rocketmq|Cisco|Joomla|kafka|pfSense|sonicwall|Jenkins|GlobalProtect|Sentinel|AEM|Airflow|Zimbra|CPanel|cacti|jellyfin|ActiveMQ|phpLDAPadmin' | unew -el -i interesting_tech_alivesubs.txt
cat httpx.txt | awk '{print $1}' | grep -aEi '(^|[.-])(admin|administrator|auth|login|signin|sso|oauth|portal|dashboard|panel|cpanel|webmail|mail|exchange|dev|develop|development|test|testing|qa|quality|staging|stage|beta|alpha|demo|sandbox|lab|labs|preprod|pre-prod|prod|production|app|api|backend|frontend|web|secure|internal|intranet|extranet|private|grafana|kibana|prometheus|nagios|zabbix|cacti|splunk|elk|logs|metrics|monitoring|status|health|analytics|git|gitlab|github|bitbucket|svn|jenkins|build|ci|deploy|deployment|pipeline|db|database|mysql|postgres|mongodb|redis|elastic|elasticsearch|sql|phpmyadmin|adminer|support|help|helpdesk|ticket|tickets|service|services|customer|client|crm|vpn|remote|rdp|ssh|ftp|sftp|webvpn|citrix|vmware|horizon|backup|backups|old|legacy|archive|temp|tmp|upload|uploads|file|files)(\.|$)' | unew -el -i interesting_alivesubs.txt
choose any one methodology from the above one.