Subdomain Discovery

Starter Zone
5

i prefer NMAP module DNS-BRUTE with some custom subdomain lists
http://blog.x1622.com/2016/11/subdomain-discovery-with-nmap-and.html