amass

In-depth subdomain enumeration / asset discovery (OWASP). Authorized testing only.

$ amass enum -d target.example
$ amass enum -passive -d target.example
$ amass intel -org 'Target Corp'