subfinderrecon
What is the purpose of subfinder?
Subfinder is a subdomain discovery tool that finds and returns valid subdomains for websites. It is widely used for subdomain enumeration in the reconnaissance phase of security assessments, identifying potential attack surfaces by revealing hidden or forgotten subdomains, and can be easily integrated into broader reconnaissance workflows.
Core Features
- Fast and powerful resolver and wildcard removal module
- Passive sources list, carefully hand-picked for maximum results
- Supports multiple formats, such as JSON, File, Stdout
- Optimized for speed—Lightning fast, feather-light on resources
Common Subfinder Commands
1. Subdomain Enumeration
This command starts the subdomain enumeration process for the specified domain.
bash
subfinder -d <domain>2. Output to File
Outputs the discovered subdomains to a specified file.
bash
subfinder -d <domain> -o <file>3. Specify Threads
Specifies the number of threads to use during subdomain enumeration, optimizing speed.
bash
subfinder -d <domain> -t <threads>4. Use All Sources
Performs enumeration using all resources available in Subfinder to maximize potential output.
bash
subfinder -d <domain> -allOutput Examples of Subfinder Commands
Found subdomains for example.com:
- sub1.example.com
- sub2.example.com
- api.example.com