Google Dorks

Dorks

site:site.com filetype:pdf

- crt.sh - search through certificates

%.site.com

Asset finder: https://github.com/tomnomnom/assetfinder

assetfinder <DOMAIN>

assetfinder <DOMAIN> | grep <DOMAIN> | sort -u

amass

amass enum -d <DOMAIN>

httpprobe

cat <SUBDOMAINSLIST> | grep <domain> | sort -u | httpprobe -prefer-https | grep https