Finding subdomains

There are several ways to attempt to find subdomains for a given domain.

1. The methods listed on Site exploration
2. Use Merklemap: https://www.merklemap.com/ ([CLI], gratis API)
3. Use SecurityTrail: https://securitytrails.com/ (subdomains requires auth, bugmenot has working logins) (Cloudflare JS)
4. Use Subdomain Finder: https://subdomainfinder.c99.nl/ Paid API also available.
5. Use Subdomain Center: https://www.subdomain.center/
6. Use DNSdumpster: https://dnsdumpster.com/
7. Search Chrome User Experience Report origin lists, which contain domains collected using telemetry in the Chrome browser. See https://archive.org/details/crux_origin_list
8. Use Cisco Umbrella (OpenDNS) top domains lists: http://s3-us-west-1.amazonaws.com/umbrella-static/index.html
9. https://osint.sh/subdomain/ (Cloudflare JS)
10. Certificate transparency logs: https://crt.sh/
11. Software options:
    1. Subfinder, which includes several of the above methods: https://github.com/projectdiscovery/subfinder
    2. assetfinder: https://github.com/tomnomnom/assetfinder
    3. Knockpy: https://github.com/guelfoweb/knock
    4. dnsenum2: https://github.com/SparrowOchon/dnsenum2
    5. dnsmap: https://github.com/resurrecting-open-source-projects/dnsmap
    6. gobuster: https://github.com/OJ/gobuster
    7. Sublist3r: https://github.com/aboul3la/Sublist3r
    8. Altdns: https://github.com/infosec-au/altdns
12. Twitter search
13. Archive.Today, with asterisk: https://archive.today/*.example.org
14. Additional methods: https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6