lazyRecon is an all in one Recon tool, Complete with subdomain enumeration, "Alive checks", and tech detection with more features planned in the future, including domain flyover screenshots, and subdomain takeover detection
Create custom subdomain enumeration instead of using subfinders library, will probably keep wappalyzergo for ease of use potentially create a cred harvester from js source code implement custom AEM recon implement graphql introspection