https://github.com/aboul3la/Sublist3r

Basis

sublist3r.py -d [TARGET_DOMAIN]
Find subdomains (using search engines).