Useful tools I found for subdomain enumeration
https://github.com/OWASP/Amassarrow-up-right
https://github.com/projectdiscovery/subfinderarrow-up-right