OWASP Amass: 20 Commands for Attack Surface Mapping and Subdomain Enumeration
OWASP Amass is the most comprehensive tool for attack surface mapping and asset discovery. It goes beyond simple subdomain enumeration by mapping relationships between domains, IP addresses, netblocks, and autonomous systems. Amass integrates with over 50 passive data sources and supports active reconnaissance techniques including DNS brute forcing, zone transfer attempts, and certificate…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.