- List of multiple scripts for doing active / passive subdomains enumeration
- Recon trough public web archive / API
- Recon using tools like sublister / amass
- Nmap scan of common port on alive subdomains
Only at educational purpose and to be run with the authorization of the target