https://github.com/darkoperator/dnsrecon

DNSRECON Base :

dnsrecon -t brt -d [TARGET_DOMAIN]
Find subdomains (brute force).