How to Find Out Subdomains With Dnsmap Tool on BackTrack 5?
The dnsmap tool uses an approach similar to that of dnswalk and dnsenum to find out subdomains. It comes with a built-in wordlist for brute forcing, and it can also use a user-supplied wordlist.