Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/AeonDave/malskill --skill subfinderThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | subfinder |
| description | Auth/lab ref: Passive subdomain enumeration tool using 40+ OSINT sources. |
| license | MIT |
| compatibility | Linux, Windows, macOS. |
| metadata | {"author":"AeonDave","version":"1.1"} |
Fast passive subdomain enumeration — part of the ProjectDiscovery toolkit.
# Enumerate subdomains for a domain
subfinder -d example.com
# Output to file
subfinder -d example.com -o subs.txt
# Silent mode (subdomains only, no banner)
subfinder -d example.com -silent
| Flag | Description |
|---|---|
-d <domain> | Target domain |
-dL <file> | List of domains from file |
-o <file> | Output file |
-oJ | JSON output |
-silent | Print subdomains only |
-t <n> | Threads (default 10) |
-timeout <n> | Timeout per source (seconds) |
-all | Use all sources (slower, more results) |
-recursive | Enumerate recursively |
-active | Active DNS verification of results |
-v | Verbose output |
Configure API keys in ~/.config/subfinder/provider-config.yaml:
shodan:
- YOUR_SHODAN_KEY
virustotal:
- YOUR_VT_KEY
censys:
- YOUR_CENSYS_ID:YOUR_SECRET
binaryedge:
- YOUR_KEY
Without API keys, subfinder still uses free sources (crt.sh, hackertarget, etc.).
# Enumerate + pipe to httpx for live host check
subfinder -d example.com -silent | httpx -silent
# Recursive enumeration
subfinder -d example.com -recursive -silent -o all_subs.txt
# Multiple domains from file
subfinder -dL domains.txt -silent -o subs.txt
# Use all sources for maximum coverage
subfinder -d example.com -all -silent
# JSON output for automation
subfinder -d example.com -oJ -o subs.json
# Subdomain → live hosts → web fingerprint → screenshot
subfinder -d target.com -silent -all | \
dnsx -silent -a -resp | \
awk '{print $1}' | \
httpx -silent -status-code -title -tech-detect | \
tee web_services.txt
# Find admin/login panels in results
grep -iE "admin|login|portal|dashboard|manage" web_services.txt
| File | When to load |
|---|---|
references/providers.md | Full passive source list, API key setup for all 40+ providers |