crt.sh#

https://crt.sh

Security Trails#

https://securitytrails.com/

Subfinder#

subfinder -d target.com | tee subdomains.txt

Add as many API key as you can to take the best of the tool

Amass#

amass enum -d target.com

Claude Code#

Prompt:

Run subfinder + crt.sh for target.com, probe with httpx, rank results by attack surface priority, flag takeover candidates