Wordlists i'am using for bug bounty
Using subdomain-takeover and search subdomain exploration.
Wordlist with many characters, it may take days to finish
Wordlist based - https://github.com/danielmiessler/SecLists
Wordlist based - https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056