Subdomainfinder:
https://subdomainfinder.c99.nl
Copy and paste subdomains to a file i.e subs.txt
Subdog:
echo "target.com" | subdog --all --silent | unew subs.txt
Use this site to gather more subdomains make sure to filter the output for better txt file.
Dorking:
https://dorks.krazeplanet.com for finding subdomains and to find sensitive info.
Some subdomains run on different ports,so it is better to check before validating a subdomain.
Naabu:
echo "ssodev.sunjin.com" | naabu -duc -silent
cat subs.txt | naabu -passive
NmapScan: