Amass

Use amass enum -h, amass intel -h and amass db -h for the installed version: flags and configuration differ between releases. See the official documentation for installation, data-source configuration and database setup.

amass enum -passive -d example.com -o subdomains.txt

Passive collection queries external providers, which receive the domain. Check configured provider coverage and source errors; no result is not proof of absence. Review discovered names against scope before resolving or probing them.