subdomain enumeration with nmap & google's CT database
~ $
# nmap --script hostmap-crtsh.nse kali.org
Description
Finds subdomains of a web server by querying Google's Certificate Transparency logs database (https://crt.sh). The script will run against any target that has a name, either specified on the command line or obtained via reverse-DNS. Note : The same goal can be achieved by %.domain.com on the crt.sh site