performing-subdomain-enumeration-with-subfinder

name	performing-subdomain-enumeration-with-subfinder
description	Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.
domain	cybersecurity
subdomain	web-application-security
tags	["subdomain-enumeration","reconnaissance","bug-bounty","attack-surface","subfinder","passive-recon","osint"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"]
mitre_attack	["T1190","T1059.007","T1505.003","T1083","T1595"]

Performing Subdomain Enumeration with Subfinder

When to Use

• During the reconnaissance phase of penetration testing or bug bounty hunting
• When mapping the external attack surface of a target organization
• Before performing vulnerability scanning on discovered subdomains
• When building an asset inventory for continuous security monitoring
• During red team engagements requiring passive information gathering

Prerequisites

• Go 1.21+ installed for building from source
• Subfinder v2 installed (go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest)
• API keys configured for passive sources (Shodan, Censys, VirusTotal, SecurityTrails, Chaos)
• Provider configuration file at $HOME/.config/subfinder/provider-config.yaml
• Network access to passive DNS and certificate transparency sources
• httpx or httprobe for validating discovered subdomains

Workflow

Step 1 — Install and Configure Subfinder

# Install subfinder
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Verify installation
subfinder -version

# Configure API keys for enhanced results
mkdir -p $HOME/.config/subfinder
cat > $HOME/.config/subfinder/provider-config.yaml << 'EOF'
shodan:
  - YOUR_SHODAN_API_KEY
censys:
  - YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET
virustotal:
  - YOUR_VT_API_KEY
securitytrails:
  - YOUR_ST_API_KEY
chaos:
  - YOUR_CHAOS_API_KEY
EOF

Step 2 — Run Basic Subdomain Enumeration

# Single domain enumeration
subfinder -d example.com -o subdomains.txt

# Multiple domains from a file
subfinder -dL domains.txt -o all_subdomains.txt

# Use all passive sources (slower but more thorough)
subfinder -d example.com -all -o subdomains_all.txt

# Silent mode for piping to other tools
subfinder -d example.com -silent | httpx -silent -status-code

Step 3 — Filter and Customize Source Selection

# Use specific sources only
subfinder -d example.com -s crtsh,virustotal,shodan -o filtered.txt


subfinder -d example.com -es github -o results.txt


subfinder -d example.com -recursive -o recursive_subs.txt


subfinder -d example.com -m  -o matched.txt