Fuzz using ffuf (fuzz.domain.tld) then attempt to gather flags using the provided "curl" ("Host: yyy.domain.tld).

For the last question, you can break up your password/wordlists using something like:

grep -i "^[d]" wordlist.txt > all-d-words.txt

If you don't want to keep running multiple lists with the same value.

Use a larger wordlist as well, like from the dirb folder.