REM subfinder (Windows binary)
subfinder.exe -d site.uz -silent -o subs.txt

REM crt.sh (PowerShell)
$r = Invoke-RestMethod "https://crt.sh/?q=%25.site.uz&output=json"
$r | ForEach-Object {{ $_.name_value -split "`n" }} | Sort-Object -Unique

REM Resolve-DnsName (bruteforce)
$list = Get-Content biglist.txt
foreach ($s in $list) {{
  $r = Resolve-DnsName "$s.site.uz" -ErrorAction SilentlyContinue
  if ($r) {{ "$s.site.uz" }}
}} | Tee-Object dns-found.txt

REM nmap (DNS scriptlari bilan)
nmap --script dns-brute -d site.uz --script-args dns-brute.domain=site.uz

REM JS dan link (PowerShell)
$js = (Invoke-WebRequest https://site.uz/).Content
[regex]::Matches($js, 'https?://[a-z0-9.-]+\.uz') | ForEach-Object {{ $_.Value }} | Sort-Object -Unique

REM topshilganlarni tekshirish
Get-Content subs.txt | ForEach-Object {{
  $c = (Invoke-WebRequest "https://$_" -UseBasicParsing -ErrorAction SilentlyContinue)
  if ($c) {{ "  $_ -> $($c.StatusCode)" }}
}}

# crt.sh — brauzerda ochish
https://crt.sh/?q=%25.site.uz

# JS fayllarni yuklab tekshirish (brauzer konsolida)
(async () => {{
  const r = await fetch('/');
  const html = await r.text();
  const srcs = [...html.matchAll(/src="([^"]+\.js)"/g)].map(m => m[1]);
  const hosts = new Set();
  for (const s of srcs) {{
    const t = await (await fetch(s)).text();
    for (const m of t.matchAll(/https?:\/\/[a-z0-9.-]+\.uz/g)) hosts.add(m[0]);
  }}
  console.log([...hosts]);
}})();

# Wayback Machine (arxividan)
// https://web.archive.org/cdx/search/cdx?url=*.site.uz/*&output=json&limit=200