Port scanner. Check how many sub domains you can find to map your attack...