amass-enum
Find subdomains of a domain. tldr-pages
On several platforms
Several platforms
Find (passively) subdomains of a domain
amass enum -d domain_nameIdentifyFind subdomains of a domain and actively verify them attempting to resolve the found subdomains
amass enum -active -d domain_name -p 80,443,8080IdentifyDo a brute force search for subdomains
amass enum -brute -d domain_nameIdentifySave the results to a text file
amass enum -o output_file -d domain_nameIdentifySave terminal output to a file and other detailed output to a directory
amass enum -o output_file -dir path/to/directory -d domain_nameIdentifyList all available data sources
amass enum -listIdentify