There are 5 methods which most of the Subdomain Enumeration tools use:
Google Dorks
Brute Forcing
Third party services
SSL/TLS Certificates
DNS Zone Transfers
I know there are famous tools too like Amass, Assetfinder, subfinder, Sublist3r and PureDns. Just happened to me that we can also use cloudflare for that too. For example in your cloudflare account add a new site and cloudflare imports it DNS record showing all subdomains.
This method does not reveal ip behind cloudflare however you may find few sub domains without proxy and pointing to their hosting server.✔
