• Domain information is a core component of any penetration test, and it is not just about the subdomains but about the entire presence on the Internet.

https://crt.sh/

https://domain.glass/

https://buckets.grayhatwarfare.com/

Certificate Transparency

curl -s <https://crt.sh/\\?q\\=inlanefreight.com\\&output\\=json> | jq .

We can also have them filtered by unique subdomain

curl -s <https://crt.sh/\\?q\\=inlanefreight.com\\&output\\=json> | jq . | grep name | cut -d":" -f2 | grep -v "CN=" | cut -d'"' -f2 | awk '{gsub(/\\\\n/,"\\n");}1;' | sort -u

we can identify the hosts directly accessible from the Internet and not hosted by third-party providers.

 for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f1,4;done

Shodan - IP List

for i in $(cat subdomainlist);do host $i | grep "has address" | grep inlanefreight.com | cut -d" " -f4 >> ip-addresses.txt;done
for i in $(cat ip-addresses.txt);do shodan host $i;done

DNS Records

dig any inlanefreight.com