Subfinder

Run 'subfinder -d example.com' for a basic passive scan. Add '-all' to query every configured source, '-o results.txt' to save output, and '-json' for structured JSON with source attribution. Pipe results into httpx for live-host validation: 'subfinder -d example.com -silent | httpx'.

The -d flag specifies the target domain: 'subfinder -d example.com'. The -o flag writes results to a file: 'subfinder -d example.com -o results.txt'. Use -dL instead of -d to read multiple domains from a text file.

Very accurate for subdomains recorded in public sources. Results may include stale subdomains that no longer resolve, so pipe output into httpx to validate which ones are live.

Plain text by default (one subdomain per line). Use -json for structured output that includes the source that found each subdomain. Use -silent to suppress the banner for clean piping.

Yes, Subfinder is a staple of bug bounty reconnaissance. Hunters use it as the first step to map a program's attack surface, because passive enumeration stays within scope and does not trigger security alerts.

Download from GitHub: 'github.com/projectdiscovery/subfinder/releases' has prebuilt binaries for Linux, macOS, and Windows. Or install via package managers: 'sudo apt install subfinder' (Kali/Debian), 'brew install subfinder' (macOS), or 'go install' from source.

Subfinder is a passive subdomain discovery tool that finds valid subdomains of a target domain using public online sources. Developed by ProjectDiscovery and written in Go, it queries Certificate Transparency logs, passive DNS databases, search engines, and security APIs without sending any traffic to the target, which makes it fast and safe for reconnaissance.

Subfinder works by asking many third-party data sources what subdomains they already know about for your target. It collects answers from sources like crt.sh, VirusTotal, and Shodan, removes duplicates, optionally filters wildcards, and prints a clean, unique list. Because all the lookups happen against public sources and not the target itself, the whole reconnaissance process is completely passive.

Yes. Subfinder is free and open source under the MIT license. You can download it, read the source code, and use it in personal or professional engagements at no cost. Some optional data sources need free API keys, but the tool itself never charges anything.

Subfinder is developed and maintained by ProjectDiscovery, an open-source security company that builds a popular ecosystem of reconnaissance tools including httpx, nuclei, naabu, and dnsx. Subfinder is designed to integrate cleanly with these other tools.

ProjectDiscovery is an open-source company that creates fast, automation-friendly security tools for reconnaissance and vulnerability scanning. Its tools — Subfinder for subdomains, httpx for HTTP probing, and nuclei for vulnerability detection — are widely used together to build modern bug bounty and penetration testing pipelines.

Subfinder is a passive tool. It never sends probes, brute-force requests, or DNS queries directly to the target's infrastructure. Instead it gathers already-public data from external sources, so the target sees no traffic from your enumeration. For active discovery you would combine it with a tool such as Amass in active mode.

Absolutely. Subfinder is one of the most beginner-friendly recon tools because a full scan is a single command: subfinder -d example.com. There are no complex configuration files needed to get started, and you can practise safely in our Terminal Sandbox before running it against real, authorised targets.

Yes, Subfinder is a staple of bug bounty reconnaissance. Hunters use it as the first step to map a program's attack surface, because passive enumeration stays within scope and does not trigger security alerts. As part of a wider bug bounty OSINT process, the discovered subdomains are then probed with httpx and tested with nuclei.

Subfinder is accurate for subdomains that have appeared in public records such as TLS certificates and passive DNS. Its coverage improves dramatically when you add API keys and use the -all flag. It will not find subdomains that were never publicly logged, so pairing it with active tools gives the most complete picture.

Subfinder can uncover forgotten or lightly-used subdomains such as staging, dev, and admin hosts, as long as those names were recorded by a public source like a certificate log. It cannot discover truly private subdomains that were never published anywhere. For unpublished names, combine Subfinder with DNS enumeration and brute-forcing tools.

No, Subfinder runs without any API keys and still returns useful results from free sources. However, adding free API keys for services like SecurityTrails, Shodan, VirusTotal, and Censys unlocks many more sources and can double or triple the number of subdomains discovered. Keys are stored in ~/.config/subfinder/provider-config.yaml.

Subfinder is written in Go (Golang). Go gives the tool its speed, easy cross-platform single-binary distribution for Linux, macOS, and Windows, and highly concurrent querying of many data sources at once, which is why Subfinder can enumerate subdomains so quickly.

Subfinder is passive-only and extremely fast, ideal for a quick first pass. Amass is a heavier OWASP project that supports both passive and active enumeration, DNS brute-forcing, and network mapping. Use Subfinder for speed and stealth, and Amass when you need deeper, active attack-surface mapping. Many professionals run both and merge the results.

Both are passive subdomain tools, but Subfinder queries a larger set of sources, supports API keys, JSON output, recursion, and resolution filtering, and is actively maintained by ProjectDiscovery. Assetfinder is a lightweight single-purpose utility. Subfinder is generally the better default for thorough passive enumeration.

theHarvester is a broad OSINT tool that gathers emails, names, hosts, and subdomains from public sources, while Subfinder focuses purely on fast, high-coverage subdomain discovery. They complement each other: use theHarvester for wide OSINT and Subfinder for the deepest subdomain list.

On Kali Linux, which ships with a large collection of Kali Linux tools, run 'sudo apt update && sudo apt install subfinder'. To install the very latest version instead, use Go: 'go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest'. Verify the install with 'subfinder -version'.

Use the -o flag, for example 'subfinder -d example.com -o results.txt'. For structured output use '-json -o results.json', and to append results from many domains use -dL with a domains list. Saved files are ready to feed into other reconnaissance tools.

Add free API keys in the provider config, run with the -all flag to enable every source, and use -recursive to enumerate subdomains of subdomains. Combining these three steps gives you the widest passive coverage Subfinder can offer.

First confirm the domain is spelled correctly and is a root domain (example.com, not http://example.com). Then add API keys and run with -all, since the free sources alone may return little for smaller domains. A network or proxy issue can also block source queries, so check your connection using basic Linux commands like ping and curl.

Yes. Subfinder's silent mode and clean stdout make it ideal for automation. A common pipeline is 'subfinder -d target.com -silent | httpx -silent | nuclei', which discovers subdomains, finds the live ones, and scans them for vulnerabilities. It runs well in cron jobs and CI/CD for continuous attack-surface monitoring.

Edit the provider config at ~/.config/subfinder/provider-config.yaml and add each service's key under its name, for example 'virustotal: [YOUR_KEY]'. Free keys are available from SecurityTrails, Shodan, VirusTotal, Censys, and GitHub. After saving, run 'subfinder -d example.com -all' to use every configured source. Keep this file private since it contains secrets.

The -all flag tells Subfinder to query every configured data source rather than just the fast default set. It maximises subdomain coverage at the cost of a slightly slower scan and more API usage. Combine -all with API keys for the widest possible passive results.

Subfinder is passive: it collects subdomains that already exist in public records without querying the target. A DNS brute-force tool like DNSenum actively guesses names against the target's DNS servers. Passive enumeration is stealthy and in-scope for most bug bounties, while brute-forcing finds unpublished names but generates traffic.

Subfinder focuses on discovery, not resolution. Pipe its output into a resolver or into httpx to confirm which subdomains are live: 'subfinder -d example.com -silent | httpx -silent'. This filters a large name list down to hosts that actually respond, which is the practical next step in recon.

Yes. Because Subfinder is a single Go binary, it runs on Windows, macOS, and Linux. Download the release for your platform from the ProjectDiscovery GitHub, or install with 'go install' if you have Go. The commands and provider config work identically across all three operating systems.

If you installed via apt, run 'sudo apt update && sudo apt upgrade subfinder'. If you installed with Go, re-run 'go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest'. Keeping Subfinder current matters because data-source integrations change over time. Check your version with 'subfinder -version'.

Different sources often report the same subdomain, and some domains use wildcard DNS that makes every random name resolve. Subfinder deduplicates automatically, and you can add resolution filtering (pipe into httpx or dnsx) to drop wildcard noise. Always validate results before treating them as real assets.

Subfinder only queries public data sources, so passive enumeration is low-risk, but you should still only enumerate domains you own or are explicitly authorised to test. Follow the rules of engagement for penetration tests and the scope of bug bounty programs. When in doubt, practise on your own domains or in the Terminal Sandbox.

Subfinder is typically the first step: it maps the subdomain attack surface passively. Its output feeds httpx to find live hosts, then nuclei for vulnerability scanning, and tools like Amass or DNSenum for deeper active coverage. This chain is the backbone of a modern passive-first reconnaissance workflow.

Subfinder supports plain text (default), JSON with '-json' for structured automation, and can write to a file with '-o'. JSON output includes the source that found each subdomain, which is useful for auditing and for feeding results into other tools programmatically.

Yes. The -recursive flag makes Subfinder enumerate subdomains of the subdomains it discovers, which can surface deeper nested hosts. Recursion increases runtime and source usage, so combine it with -all and API keys when you need the most thorough passive map for a large target.