Exploring internal structure of webservers

Anybody has any experience with exploration of internal structure of webservers? I mean with uncovering internal subdomains and hidden directories. Any tips for Subdomain Finder tools (like CT-Exposer, DNSRecon, SubBrute, Sublist3r, Aquatone, Knock,...)? Any tips for Website Directory Scanners? Does anybody know any good (and preferbaly free) online (browser) tools? Pentest-tools allows you only 2 free scans and even those are limited. The directory scanner from sitechecker.pro literally blurs out most of the results you get and you are expected to pay for more. I know about censys.io and the possibility to find subdomains via their certificate check.

And yes, I know about that you can use search engines for some of this stuff as well.

you could probably write your own script with some combination of drill/dig and nmap. if you want to enumerate documents on a webserver and not just look at dns you probably want to script something using selenium.

I've found that the best methods for directory and file scanning are fuzzers. wfuzz is a great tool to use but it's very loud. You can find good word lists for it from the sectools word lists on Github It might even do subdomains too if you can put the substitution variable in the domain name. I'm not sure though, I haven't tried.

>>10909 I use gobuster for directory searching but I mainly do CTF's. Like others have said fuzzing,dig, ectr..and based off the tools you listed you should have plenty to work with.

why not just use gobuster or dirb?

mostly using dirb + wordlists common from seclists or wfuzz

Gobuster for directory enumeration for subdomains its all about OWASP's amass.