man3kin3ko

sed -e 's/^/https:\/\//' subdomains > subdomains.schema
ffuf -w "/path/to/dict:FUZZ" -w "subdomains.schema:HOST" -u HOST/FUZZ -mc all -rate 100 -o fuzz-subdomains.json -c H "User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1; +http://www.google.com/bot.html) Chrome/W.X.Y.Z Safari/537.36" -fc 404

man3kin3ko

# filter ffuf output

cat output.json | jq 'results[] | select(.status==200) | .url'
cat output.json | jq -S 'results | =sort_by(.url) | .results[] | select(.status==200) | {url: .url,len: .length}'

# filter bbot output

cat output.json | jq 'select(.type=="DNS_NAME") | .data' | tr -d '"' | sort | uniq > subdomains.txt

man3kin3ko

DOMAIN=domain.com
NS=ns.domain.com
dig -t AXFR $DOMAIN @$NS
dig +noall +answer +multiline $DOMAIN any @$NS