DNSENUM

root@oco:~$ find / -iname subdomain* -type f 2>/dev/null

root@oco:~$ nano /etc/hosts
 {targetIP} targetFQDN

root@oco:~$ dnsenum --enum {targetSite:port} -f /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -r
 * the -r option enables recursive subdomain brute-forcing. if a subdomain is found, dnsenum will try to enumerate subdomains of that subdomain