Third Party
Waybackmachine & others
Use gau to search for old files and paths from crawl websites
echo "example.com" | gau --subs
# https://github.com/hahwul/urx
# same archives as gau, plus urlscan, VirusTotal and GitHub code search
urx example.com --subs
# filter straight to the files worth pulling
urx example.com --subs -e js,json,bak,old,zip,sqlAlienvault
Look under Associated Urls
https://otx.alienvault.com/indicator/domain/example.com
AWS Scraping
By visiting IP’s under AWS control and looking for certificates it is possible to find content owned by a company.
https://github.com/jhaddix/awsScrape/