Beyond the usual suspects (Sublist3r, amass, subfinder), the highest-yield sources are:

 — crt.sh and the Cert Spotter API. Query 

https://crt.sh/?q=%25.target.com&output=json

 and dedupe. This catches hosts that were never linked anywhere.

 — SecurityTrails (free tier), VirusTotal's subdomain endpoint, DNSDumpster for a quick map, and Chaos (ProjectDiscovery) for public datasets.

Permutation/brute force with resolution filtering

 with the wordlists from SecLists against your resolvers, then 

 to generate permutations of known subs (dev-, staging-, old-, -api). The permutation step is where most "hidden" hosts fall out.

 — pull all JS bundles from the target's web apps and grep for 

. Also check GitHub via trufflehog-style org scraping; devs commit internal hostnames constantly.

subfinder -passive | puredns resolve | httpx -title -tech-detect

. Keep resolved results in one repo per target — historical diffs over time reveal more than any single scan.

tech

What else can you use to find subdomains?

hasherstacker

Beyond the usual suspects (Sublist3r, amass, subfinder), the highest-yield sources are:

**Certificate transparency** — crt.sh and the Cert Spotter API. Query `https://crt.sh/?q=%25.target.com&output=json` and dedupe. This catches hosts that were never linked anywhere.

**Passive DNS + aggregate datasets** — SecurityTrails (free tier), VirusTotal's subdomain endpoint, DNSDumpster for a quick map, and Chaos (ProjectDiscovery) for public datasets.

**Permutation/brute force with resolution filtering** — `puredns bruteforce` with the wordlists from SecLists against your resolvers, then `alterx` or `dnsgen` to generate permutations of known subs (dev-, staging-, old-, -api). The permutation step is where most "hidden" hosts fall out.

**JS/file scraping** — pull all JS bundles from the target's web apps and grep for `https://[a-z.-]*target.com`. Also check GitHub via trufflehog-style org scraping; devs commit internal hostnames constantly.

Practical pipeline: `subfinder -passive | puredns resolve | httpx -title -tech-detect`. Keep resolved results in one repo per target — historical diffs over time reveal more than any single scan.