Subdomain Discovery - Initial Contact with the Target Resources: Google VRP: https://www.google.com/about/appsecurity/reward-program/ amass - https://github.com/OWASP/Amass findomain https://github.com/Edu4rdSHL/findomain assetfinder - https://github.com/tomnomnom/assetfinder subbrute - https://github.com/TheRook/subbrute crtsh - CLI - https://github.com/appsecco/the-art-of-subdomain- enumeration/blob/master/crtsh_enum_web.py Free book: https://github.com/appsecco/the-art-of-subdomain-enumeration https://appsecco.com/books/subdomain-enumeration/