BBH_w_claude

./reconftw.sh -d unomaha.edu -s -o ~/reconftw/Recon/unomaha.edu

Using tree -h .

Now rending for live hosts:

httpx -l subdomains/subdomains.txt -p 80,443,8000,8080,8443,9000,9443 -status-code -title -o webs/webs_uncommon_ports.txt

Another way

chaos -d target.com -o chaos.txt
 
subfinder -d target.com -all -recursive -o passive.txt
 
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' >> passive.txt

cat chaos.txt passive.txt | sort -u | dnsx -a -cname -resp -silent -o resolved.txt

cat resolved.txt | dnsgen - | puredns resolve —resolvers resolvers.txt —write permuted.txt

httpx -l resolved.txt -silent | getJS —complete | grep -oE ’([a-zA-Z0-9-]+.)+target.com’

ffuf -w wordlist.txt -H “Host: FUZZ.target.com” -u https:/// -mc 200,301,302,403