Assetfinder

#Enumerate subdomains using OSINT:

assetfinder --subs-only target.com | grep -v '*' | tee assetfinder_results.txt