We all know about the famous spyse.com this python3 scripts scrounges subdomains without the api. There is an option of getting the api, in fact that's what I recommend using the api they provide. Because this methods below may not bring out all subdomains as the api can and perhaps the portability also.
You must have pip installed on your system
$ git clone https://www.nmmapper.com/sys/tools/subdomainfinder/
$ python3 -m venv myenv
# after activing your virtualenv
pip3 install -r requirements.txt$ python3 spyse.py -d nmmapper.com
[
"wss.nmmapper.com",
"webook.nmmapper.com",
"mail.nmmapper.com",
"nwebook.nmmapper.com",
"nmail.nmmapper.com"
]This tool is still in development. If you want a mature subdomain finder either a script or subdomain finders hosted online here are some details.