recon-ng hackertarget , google_site_web

The recon-ng tool in kali runs a lot like metasploit but is designed for recon activities such as

recon-ng

use recon/domains-hosts/hackertarget
set SOURCE baddomain.com
run

which will list all subdomains & their ips for a particular malicious domain




or

use recon/domains-hosts/google_site_web
set SOURCE baddomain.com
run

which will google search and return all sub domains it found for the bad site on google