Since public DNS zone transfers are prohibited, you can use this tiny Java program to get the subdomains of a given domain by brute-force. See file’s comments for more details. You may want to get the subs.list file to use in conjunction with DomainBF.
by 