sublister for domain enum(sublister -d [site] -o subdomains.txt): when you see 403 forbidden ⇒ dir bruteforce (AMASS enum -brute -active -d [site] | anew subdomains.txt)