dnsmap
Scan a domain for common subdomains e.g. tldr-pages
On Linux
Linux
Scan a domain for common subdomains e.g. smtp.domain.org.
Scan for subdomains using the internal wordlist
dnsmap example.comIdentifySpecify a list of subdomains to check for
dnsmap example.com -w path/to/wordlist.txtIdentifyStore results to a CSV file
dnsmap example.com -c path/to/file.csvIdentifyIgnore 2 IPs that are false positives (up to 5 possible)
dnsmap example.com -i 123.45.67.89,98.76.54.32Identify