sub-domain enumeration techniques is now on offsec.tools check it out!