Enumerate domains using a directory attack to find common subdomains.
Explore the docs »
Clone this repository, then you will be able to use dnslookup and modify the source code if needed.
you can get the wordlist at https://github.com/rbsec/dnscan/blob/master/subdomains-1000.txt
./dnslookup wordlist domain