Subwiz https://github.com/hadriansecurity/subwiz can pre­dict pos­si­ble sub­do­mains via a LLM. Subfinder https://github.com/projectdiscovery/subfinder tries to get sub­do­mains via pas­sive infor­ma­tion gathering. Gobuster Gob­uster can brute-force subdomains.