assetfinder
Find domains and subdomains related to a given domain
...It queries services such as certificate transparency logs, threat intelligence platforms, and passive DNS providers to build a comprehensive list of related assets. The tool is widely used in bug bounty programs and penetration testing to map an organization’s external attack surface. It supports optional filtering to return only subdomains, allowing users to focus on specific reconnaissance needs. assetfinder is lightweight and easy to use, typically requiring only a single command to produce results, making it ideal for quick enumeration tasks. ...