https://github.com/darkoperator/dnsrecon

Basis

dnsrecon -t brt -d [TARGET_DOMAIN]
Find subdomains (brute force).