Disruptive Labs
A penetration tester’s guide to sub-domain enumeration
An extensive blog post on various sub-domain enumeration techniques:
https://blog.appsecco.com/a-penetration-testers-guide-to-sub-domain-enumeration-7d842d5570f6