first of all checking bug bounty checklist —»

Recon on wildcard domain

  • Run amass
  • Run subfinder
  • Run assetfinder
  • Run dnsgen
  • Run massdns
  • Use httprobe
  • Run aquatone (screenshot for alive host)