So I saw a threat on Twitter from someone more popular then me. They were asking for and tips/advice for enumerating or better, brute forcing sub domains (externally).
Someone mentioned Gotator and it looks fuckin’ awesome.
Why I say it’s a mix, it generates DNS wordlists through permutations so it’s exactly as powerful as Skipfish or as weak as crunch but it’s somewhere in between. 🙂
Something else you can use on top of this is urlcrazy. Which y’all know I’m a fan of!