Subdomain Enumeration with ffuf
Subdomain enumeration with size filter
ffuf -u 'http://harder.local/' -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H 'Host: FUZZ.harder.local' -t 100 -fs 1985
HTTPS variant
ffuf -c -u 'https://xor.com' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H 'Host: FUZZ.xor.com' -fs 0 | tee ./subdomain_discovery
Fast variant
ffuf -u 'http://vulnnet.thm/' -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 100 -H 'Host: FUZZ.vulnnet.thm'