Get all the subdomains along with their title and status code. snitch will add an output for Login pages and all 200 status pages. gau_recon will parse all js/json files to output along with some "id=" tags.
Run setup.sh
Its my go to for recon, quick and dirty.