SubzzZ can find possible subdomains using passive recon. Tool also support Permutations, Mutations, Alterations.
[✔] Crt.sh
[✔] Web.Archive.org
[✔] Dns.bufferover.run
[✔] Threatcrowd.org
[✔] Hackertarget.com
[✔] Certspotter.com
[✔] Anubis-DB(jonlu.ca)
[✔] Virustotal
[✔] Alienvault(otx)
[✔] Urlscan.io
[✔] Threatminer
[✔] Entrust.com
[✔] Riddler.io
[✔] Dnsdumpster
[✔] Rapiddns
[✔] Choas
[✔] Permutations, Mutations, Alterations
root@me_dheeraj:$ bash subzzZ
[-] Usage: ./subzzZ [-d/--domain] target.com
Output will be saved in scans/target.com-YYYY-MM-DD directory
- python3
- jq
- shuffledns @projectdiscovery
- massdns @blechschmidt
- httpx @pdiscoveryio