curl -s http://target.com | grep -Eo '"(/[^"]+)"' | sort -u > paths.txt
A small, curated list for finding the most obvious subdomains (e.g., mail , dev , stage ). gobuster wordlist