subdomain bruteforce

use dnsrecon   #dnsrecon -t brt -d domain.com

use sublister # ./sublist3r.py -d acmeitsupport.thm

 GOOGLE SEARCH  "-site:www.domain.com site:*.domain.com"

ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.acmeitsupport.thm" -u http://10.10.177.126 -fs {size}