Find Subdomains

Finding subdomains is fundamental. The more subdomains you find, the bigger attack surface you have. Which means bigger possibility of success.

For now this seems to be a very comprehensive list of tools to find subdomains.

Subdomain Finder - C99.nlsubdomainfinder.c99.nl

https://www.shodan.io/www.shodan.io

URL and website scanner - urlscan.iourlscan.io

VirusTotalVirusTotal

DNSDumpster - Find & lookup dns records for recon & researchDNSDumpster.com

https://securitytrails.com/list/apex_domain/google.comsecuritytrails.com

Reverse IP Lookup - Find Other Web Sites Hosted on a Web Serverwww.yougetsignal.com