subbrute
https://github.com/TheRook/subbrute
A DNS meta-query spider that enumerates DNS records, and subdomains
Examples
Recursive DNS spider which uses open DNS resolvers to increase anonymity when scanning
No direct requests to just one nameserver
./subbrute.py test-domain.com > list.out
Enumerate 3rd level subdomains
./subbrute.py -t list.out
Notes
Subbrute is also integrated into sublit3er tool!