It is possible to scan subdomains of network without brute-force attack?
If yes, how it works?
I tried to scan the network with some penetrating tools and it returned to me subdomain which doesn't have link on the main domain. But it didn't see the others subdomains which I know there are.
Do these penetrating tools also work on brute-force attack (like subdomain scanner)?