https://github.com/OWASP/Amass

Basis

go install github.com/OWASP/Amass/v3/...@master

amass enum -d [TARGET_DOMAIN]
Find subdomains.