Subdomains - Virtual Host Enumeration
FFUF can be used to discovery subdomains by the use of virtual hosts and changing the Host header
Try running the below ffuf:
You'll see from the results that every result comes back with a size of 1495 Bytes.
Now try running the below ffuf scan but this time using the -fs switch to filter out any results that are 1495 bytes.
This should of discovered the subdomain redhat