curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '[].name_value| sed 's/\*\.//g' | sort -u curl -s https://crt.sh/\?q\=\amazon.com\&output\=json | jq -r '.[].name_value' | grep -Po '(\w+\.\w+\.\w+)$' | anew crt-amzon.com

from certspotter curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true&expand=dns_names" | jq .[].dns_names | grep -Po "(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u

from archive curl -s "http://web.archive.org/cdx/search/cdx?url=*.target.com/*&output=text&fl=original&collapse=urlkey" | sed -e 's_https*://__' -e "s/\/.*//" | sort -u

from jldc curl -s "https://jldc.me/anubis/subdomains/target.com" | grep -Po "((http|https):\/\/)?(([\w.-]*)\.([\w]*)\.([A-z]))\w+" | sort -u curl -s "https://jldc.me/anubis/subdomains/indrive.com" | jq -r '.' | grep -o "\w.*indrive.com"

from hackertarget curl -s "https://api.hackertarget.com/hostsearch/?q=indrive.com"

from alienvault curl -s "https://otx.alienvault.com/api/v1/indicators/domain/tesla.com/url_list?limit=100&page=1" | grep -o '"hostname": *"[^"]*' | sed 's/"hostname": "//' | sort -u

from subdomaincenter curl "https://api.subdomain.center/?domain=target.com" | jq -r '.[]' | sort -u

from rapiddns

rapiddns(){ curl -s "https://rapiddns.io/subdomain/$1?full=1" \ | grep -oE "[\.a-zA-Z0–9-]+\.$1" \ | sort -u } rapiddns tesla.com

Note: use manual way to find subdomains from virustotal

https://www.virustotal.com/gui/home/search

copy that subdomains and paste those on your subs file[use only manual way to find subs from virustotal]

https://hunter.how

https://app.netlas.io/domains/?q=domain%3A*.yahoo.com%20&page=1&indices=

lets see how we can find more subdomains from github

manual:

go to this below given link replace freshworks which domain you want

you can see the results like this

open all the repositories one by one to find subdomains

automation:

use this tool to automate this process to find subdomains from github and gitlab

thankyou..

JAISHREERAM