Recon stuff

Passive

• dig (linux command)
• nslookup
• google (check out site:???.com)
• crt.sh
• waybackmachine
• DNS Dumpster
• Wolfram Alpha

Active (use a wordlist lol)

• nmap
• subbrute
• sublist3r
• dnsrecon
• altdns
• SecLists
• use a custom script maybe???