subfinder

name	subfinder
description	Auth/lab ref: Passive subdomain enumeration tool using 40+ OSINT sources.
license	MIT
compatibility	Linux, Windows, macOS.
metadata	{"author":"AeonDave","version":"1.1"}

Subfinder

Fast passive subdomain enumeration — part of the ProjectDiscovery toolkit.

Quick Start

# Enumerate subdomains for a domain
subfinder -d example.com

# Output to file
subfinder -d example.com -o subs.txt

# Silent mode (subdomains only, no banner)
subfinder -d example.com -silent

Core Flags

Flag	Description
-d <domain>	Target domain
-dL <file>	List of domains from file
-o <file>	Output file
-oJ	JSON output
-silent	Print subdomains only
-t <n>	Threads (default 10)
-timeout <n>	Timeout per source (seconds)
-all	Use all sources (slower, more results)
-recursive	Enumerate recursively
-active	Active DNS verification of results
-v	Verbose output

Provider Configuration

Configure API keys in ~/.config/subfinder/provider-config.yaml:

shodan:
  - YOUR_SHODAN_KEY
virustotal:
  - YOUR_VT_KEY
censys:
  - YOUR_CENSYS_ID:YOUR_SECRET
binaryedge:
  - YOUR_KEY

Without API keys, subfinder still uses free sources (crt.sh, hackertarget, etc.).

Common Workflows

# Enumerate + pipe to httpx for live host check
subfinder -d example.com -silent | httpx -silent

# Recursive enumeration
subfinder -d example.com -recursive -silent -o all_subs.txt

# Multiple domains from file
subfinder -dL domains.txt -silent -o subs.txt

# Use all sources for maximum coverage
subfinder -d example.com -all -silent

# JSON output for automation
subfinder -d example.com -oJ -o subs.json

Full Recon Pipeline

# Subdomain → live hosts → web fingerprint → screenshot
subfinder -d target.com -silent -all | \
  dnsx -silent -a -resp | \
  awk '{print $1}' | \
  httpx -silent -status-code -title -tech-detect | \
  tee web_services.txt

# Find admin/login panels in results
grep -iE "admin|login|portal|dashboard|manage" web_services.txt

Resources

File	When to load
references/providers.md	Full passive source list, API key setup for all 40+ providers