Sublist3r can be used to find sub domains. It should come with Kali Linux but here is an installation command if it is not.
sudo apt install sublist3r
We will start by listing the options that it has, we can use the following command.
sublist3r -h
As you can see we can use the -d option to search the domain name of our choice. Lets try listing the subdomains of google.com
sublist3r -d www.google.com
Since we can get quite a long list of results, we might want to store these results inside a file. For this, we can use the -o option to output. I will use the same command and add the output
sublist3r -d www.google.com -o results.txt
One of the underated capabilities of this tool is the ability to find sub domains that have specific open ports. We can restrict the results to only show us subdomains that have the ports we want open. We can do this as shown below.
sublist3r -d www.google.com -p 20,21