The extranonce can be found in the coinbase data from a coinbase transaction.
This data can be interpreted as a script pushing data onto the stack and the extranonce is the second value.
Example
{
...
"vin" : [
{
"coinbase" : "03443b0403858402062f503253482f",
"sequence" : 4294967295
}
],
...
}
can be interpreted as:
03 = push 3 bytes onto the stack
443b04 = 3 bytes pushed onto the stack <-- Block index
03 = push 3 bytes onto the stack
858402 = 3 bytes pushed onto the stack <-- The extranonce
06 = push 6 bytes onto the stack
2f503253482f = 6 bytes pushed onto the stack <-- arbitrary data
EDIT: This format was defined by
BIP34 and applies to blocks with version >= 2. I'm not sure how the extranonce was managed before that.