So I saw a threat on Twitter from someone more popular then me. They were asking for and tips/advice for enumerating or better, brute forcing sub domains (externally).
Someone mentioned Gotator and it looks fuckin’ awesome.
Something else you can use on top of this is urlcrazy. Which y’all know I’m a fan of!