https://github.com/aboul3la/Sublist3r https://github.com/jhaddix/domain https://github.com/guelfoweb/knock https://github.com/TheRook/subbrute https://github.com/blechschmidt/massdns https://bitbucket.org/LaNMaSteR53/recon-ng https://github.com/caffix/amass https://github.com/cakinney/domained https://github.com/rbsec/dnscan

https://github.com/michenriksen/aquatone

https://tools.kali.org/information-gathering/dnsrecon

https://www.aldeid.com/wiki/Fierce

https://github.com/OJ/gobuster

https://github.com/fwaeytens/dnsenum

https://github.com/infosec-au/altdns

https://github.com/sensepost/BiLE-suite

https://github.com/tomsteele/blacksheepwall

https://github.com/RandomStorm/Bluto

https://github.com/anshumanbh/brutesubs

https://github.com/mandatoryprogrammer/cloudflare_enum

https://github.com/UnaPibaGeek/ctfr

https://github.com/m0nad/DNS-Discovery

https://github.com/lorenzog/dns-parallel-prober

https://github.com/evilsocket/dnssearch

https://github.com/mschwager/fierce

https://github.com/mhmdiaa/second-order

https://github.com/jrozner/sonar

https://github.com/laramies/theHarvester

https://github.com/gwen001/vhost-brute

https://github.com/codingo/VHostScan

https://github.com/jobertabma/virtual-host-discovery

https://github.com/ChrisTruncer/EyeWitness

https://github.com/sharsi1/sublazerwlst

https://github.com/appsecco/the-art-of-subdomain-enumeration

https://github.com/evilsocket/xray

https://www.nlnetlabs.nl/projects/ldns/

https://dnscurve.org/nsec3walker.html

https://github.com/eldraco/domain_analyzer

https://github.com/christophetd/censys-subdomain-finder

https://github.com/n4xh4ck5/N4xD0rk

https://github.com/n4xh4ck5/V1D0m

Online DNS tools

https://hackertarget.com/

http://searchdns.netcraft.com/

https://dnsdumpster.com/

https://www.threatcrowd.org/

https://riddler.io/

https://api.passivetotal.org

https://www.censys.io

https://api.shodan.io

http://www.dnsdb.org/

https://www.dnsdb.info/

https://scans.io/

https://findsubdomains.com/

https://securitytrails.com/dns-trails

https://crt.sh/

https://certspotter.com/api/v0/certs?domain=example.com

https://transparencyreport.google.com/https/certificates

https://developers.facebook.com/tools/ct

https://google.com/transparencyreport/https/ct/

https://www.certificate-transparency.org/known-logs

Subdomains bruteforce Wordlists:

https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056

https://github.com/danTaler/WordLists

https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS

https://room362.com/storage/saved/hugelist.txt

http://wordlist.aspell.net/other-dicts/

https://www.openwall.com/wordlists/

http://www.outpost9.com/files/WordLists.html

https://packetstormsecurity.com/Crackers/wordlists/