A quick and dirty script to do a wildcard query on https://crt.sh to find subdomains using certs for domains, a good way to find subdomains.
Simply point the script at a txt file with one domain per line.
e.g. google.com
yahoo.com
bing.com
./certsearch YOUR-FILE.txt
the script will output to a file called cert-output.txt