Subdomain fuzz

Simple subdomain brute:

ffuf -c -w subdomains-top1million-110000.txt -u http://manager.htb/ -H "Host: FUZZ.manager.htb"

Lot's of 200 false positives? Exclude the number of words of the 'default' response:

-fw 6791

GitHub - ffuf/ffuf: Fast web fuzzer written in GoGitHub