There’s a lot of tools used to make this purpose like

• amass
• findomain
• crtsh
• assetfinder
• subbrute

amass amass enum -d [domain.com](<http://domain.com>)

• Note on amass 🔴

findomain findomain -t docs.google.com

crt.sh website

assetfinder assetfinder --subs-only docs.google.com

subbrute ./subbrute domain.com