Subdomain Enumeration
From DNS
dig +nocmd trick.htb axfr +noall +answer @trick.htb
WFuzz
In case the subdomain has a certain naming convention (Trick/HTB):
sed 's/^/preprod-/' subdomains-top1million-110000.txt
Then use wfuzz:
sudo wfuzz -c -f out -w wordlist -u "http://trick.htb" -H "Host: FUZZ.trick.htb" --hw 475
gobuster
DNS
|
|
vhost
|
|