Knock is a python script, written by Gianni 'guelfoweb' Amato, designed to enumerate subdomains on a target domain through a wordlist. This program is self contained, doesn't need to be installed in any particular location. All it needs is a recent version of Python 2.xOnly for use the Zone Transfer option (-zt) you must install the module dnspython, otherwise you can do without. If the name server allows zone transfers to occur, all the DNS names and IP addresses hosted by the name server will be returned in human-readable ASCII text.
Usage
$ python knock.py
Rapid Scan
Scanning with internal wordlist:
$ python knock.py
Scanning with external wordlist:
$ python knock.py
Options
-zt Zone Transfer discovery:
$ python knock.py -zt
-dns Dns resolver:
$ python knock.py -dns
-wc Wildcard testing:
$ python knock.py -wc
-wc Wildcard bypass:
$ python knock.py -bw

Download
http://code.google.com/p/knock/downloads/list