This tool combines passive and active discovery methods to help you research the subdomains of your target domain for all types of security testing engagements. Each scan delivers a list of subdomains that is validated, so you don't have to waste time with old or invalid subdomains.
git clone https://github.com/R3DHULK/find-subdomains
cd find-subdomains
python subdomain-finder.py (for use python)
or
chmod +x subdomain-finder.sh
./subdomain-finder.sh