When conducting penetration tests on a website, or on a *.domain.com scope, finding subdomains of the target can help widen the attack surface. There are many different techniques to find subdomains that can be divided in two main categories.
{% content-ref url="../../web/recon/subdomain-enum.md" %} subdomain-enum.md {% endcontent-ref %}