Getting a list of subdomains

When performing a black-box test, the client may not give us all of the subdomains of their organization. In this recipe, we will cover one of the few techniques that can be used to get a list of the subdomains of an organization.