reconFTW automates the entire process of reconnaissance for you. It outperforms the work of subdomain enumeration along with various vulnerability checks and obtaining maximum information about your target.
reconFTW uses a lot of techniques (passive, bruteforce, permutations, certificate...