k2 sub domain finder is a multi-level sub domain extractor, It uses bruteforce techniques to discover sub domains.
git clone https://github.com/blind-intruder/K2-sub-domain-finder.git
cd k2-sub-finder
chmod +x k2_sub_finder.py
python3 k2_sub_finder.py targetdomain.com
It finds the sub domains by checking the port 80/443. It has builtin wordlist of 110000 words.