One of the things I need to do from time to time is to find subdomains of a site for example.
Starting with example.com
I'm looking for any additional ways to perform recon on these targets and I want to get a list of all the subdomains of a domain.
I'm currently doing a number of things inlcuding
- using maltego to crawl for info
- Using search engines to search for subdomains
- crawling site links
- Examining DNS records
- Examining incorrectly configured SSL certificates
- Guessing things like 'vpn.example.com'
I reckon there are more than the ones i've found so far, but now I'm out of ideas.