Find subdomains using `subfinder`, crawl each for a maximum number of seconds, and write results to an [o]utput file
subfinder -list path/to/domains.txt | katana -crawl-duration value -output path/to/output.txt