A few useful buckets beyond a single subdomain tool:
Certificate Transparency — crt.sh, CertSpotter, Censys. SANs often expose names that never show up in DNS wordlists.
Passive DNS / threat-intel indexes — VirusTotal, SecurityTrails, DNSDB-style services, DNSDumpster. These recover historical names even after records disappear.
Public web/code traces — urlscan.io, Wayback/Common Crawl, GitHub/code search, CSP headers, JavaScript bundles, old config/docs. Search for wildcard-style names such as *.example.com, API base URLs, S3/cloud hostnames, and absolute links.
ASN/IP pivots — identify the organization’s ASNs/netblocks, then use reverse DNS and certificate data around those ranges. This is especially useful for legacy/internal-facing naming patterns.
Permutation generation — take confirmed names and feed patterns into dnsgen or ProjectDiscovery alterx (env, region, number, prefix/suffix variants). This usually beats a giant generic wordlist.
Resolution at scale — puredns/shuffledns/massdns with a clean resolver pool, plus wildcard detection. Keep “discovered” and “actually resolves” as separate sets.
Passive aggregators — subfinder with multiple API sources and amass passive mode are good glue, but I would still keep the raw CT/passive-DNS/history sources so you know why each name appeared.
A practical pipeline is: passive sources → normalize/dedupe → permutations from confirmed naming patterns → DNS resolve/wildcard filter → HTTP/TLS probe → feed newly confirmed names back into permutations.
If this is for an environment you are authorized to assess, I would keep active brute-force/zone-transfer attempts as a separate final phase rather than mixing them into passive discovery. The biggest marginal gains I usually see come from historical URLs/CSP/JS + passive DNS + pattern-derived permutations, not simply adding another huge wordlist.
Beyond the usual suspects (Sublist3r, amass, subfinder), the highest-yield sources are:
Certificate transparency — crt.sh and the Cert Spotter API. Query https://crt.sh/?q=%25.target.com&output=json and dedupe. This catches hosts that were never linked anywhere.
Passive DNS + aggregate datasets — SecurityTrails (free tier), VirusTotal's subdomain endpoint, DNSDumpster for a quick map, and Chaos (ProjectDiscovery) for public datasets.
Permutation/brute force with resolution filtering — puredns bruteforce with the wordlists from SecLists against your resolvers, then alterx or dnsgen to generate permutations of known subs (dev-, staging-, old-, -api). The permutation step is where most "hidden" hosts fall out.
JS/file scraping — pull all JS bundles from the target's web apps and grep for https://[a-z.-]*target.com. Also check GitHub via trufflehog-style org scraping; devs commit internal hostnames constantly.
Practical pipeline: subfinder -passive | puredns resolve | httpx -title -tech-detect. Keep resolved results in one repo per target — historical diffs over time reveal more than any single scan.
A few useful buckets beyond a single subdomain tool:
A practical pipeline is: passive sources → normalize/dedupe → permutations from confirmed naming patterns → DNS resolve/wildcard filter → HTTP/TLS probe → feed newly confirmed names back into permutations.
If this is for an environment you are authorized to assess, I would keep active brute-force/zone-transfer attempts as a separate final phase rather than mixing them into passive discovery. The biggest marginal gains I usually see come from historical URLs/CSP/JS + passive DNS + pattern-derived permutations, not simply adding another huge wordlist.
Beyond the usual suspects (Sublist3r, amass, subfinder), the highest-yield sources are:
Certificate transparency — crt.sh and the Cert Spotter API. Query
https://crt.sh/?q=%25.target.com&output=jsonand dedupe. This catches hosts that were never linked anywhere.Passive DNS + aggregate datasets — SecurityTrails (free tier), VirusTotal's subdomain endpoint, DNSDumpster for a quick map, and Chaos (ProjectDiscovery) for public datasets.
Permutation/brute force with resolution filtering —
puredns bruteforcewith the wordlists from SecLists against your resolvers, thenalterxordnsgento generate permutations of known subs (dev-, staging-, old-, -api). The permutation step is where most "hidden" hosts fall out.JS/file scraping — pull all JS bundles from the target's web apps and grep for
https://[a-z.-]*target.com. Also check GitHub via trufflehog-style org scraping; devs commit internal hostnames constantly.Practical pipeline:
subfinder -passive | puredns resolve | httpx -title -tech-detect. Keep resolved results in one repo per target — historical diffs over time reveal more than any single scan.