aeondave/subfinder

Subfinder

Fast passive subdomain enumeration — part of the ProjectDiscovery toolkit.

Quick Start

# Enumerate subdomains for a domain
subfinder -d example.com

# Output to file
subfinder -d example.com -o subs.txt

# Silent mode (subdomains only, no banner)
subfinder -d example.com -silent

Core Flags

| Flag | Description | |------|-------------| | -d <domain> | Target domain | | -dL <file> | List of domains from file | | -o <file> | Output file | | -oJ | JSON output | | -silent | Print subdomains only | | -t <n> | Threads (default 10) | | -timeout <n> | Timeout per source (seconds) | | -all | Use all sources (slower, more results) | | -recursive | Enumerate recursively | | -active | Active DNS verification of results | | -v | Verbose output |

Provider Configuration

Configure API keys in ~/.config/subfinder/provider-config.yaml:

shodan:
  - YOUR_SHODAN_KEY
virustotal:
  - YOUR_VT_KEY
censys:
  - YOUR_CENSYS_ID:YOUR_SECRET
binaryedge:
  - YOUR_KEY

Without API keys, subfinder still uses free sources (crt.sh, hackertarget, etc.).

Common Workflows

# Enumerate + pipe to httpx for live host check
subfinder -d example.com -silent | httpx -silent

# Recursive enumeration
subfinder -d example.com -recursive -silent -o all_subs.txt

# Multiple domains from file
subfinder -dL domains.txt -silent -o subs.txt

# Use all sources for maximum coverage
subfinder -d example.com -all -silent

# JSON output for automation
subfinder -d example.com -oJ -o subs.json

Full Recon Pipeline

# Subdomain → live hosts → web fingerprint → screenshot
subfinder -d target.com -silent -all | \
  dnsx -silent -a -resp | \
  awk '{print $1}' | \
  httpx -silent -status-code -title -tech-detect | \
  tee web_services.txt

# Find admin/login panels in results
grep -iE "admin|login|portal|dashboard|manage" web_services.txt

Resources

| File | When to load | |------|--------------| | references/providers.md | Full passive source list, API key setup for all 40+ providers |