Subfinder
FeaturedMIT馃攳 Subdomain Enumeration 路 Go
Subfinder is a subdomain discovery tool that returns valid subdomains for websites using passive online sources. It has a simple modular architecture and is optimized for speed. Subfinder uses multiple sources including certificate transparency logs, search engines, DNS aggregators, and more to find subdomains without ever touching the target directly. This makes it ideal for stealthy reconnaissance.
Installation
go install
$ go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latestbrew (macOS)
$ brew install subfinderdocker
$ docker pull projectdiscovery/subfinderUse Cases
- Passive subdomain enumeration for attack surface mapping
- Bug bounty reconnaissance
- Certificate transparency monitoring
- Feeding results into httpx for live host probing
Tags
Details
- Category
- 馃攳 Subdomain Enumeration
- Language
- Go
- Repository
- projectdiscovery/subfinder
- License
- MIT
- Platforms
- 馃惂linux馃崕macos馃獰windows
Links
Used in 3 Workflows
Community Reviews
Alternatives & Comparisons
Amass
GoIn-depth attack surface mapping and asset discovery. DNS enumeration, network mapping, OSINT data sources.
Compare Subfinder vs AmassKnock
PythonSubdomain enumeration tool using wordlist and DNS resolution. Supports VirusTotal and zone transfers.
Compare Subfinder vs KnockMore in Subdomain Enumeration
Amass
GoIn-depth attack surface mapping and asset discovery. DNS enumeration, network mapping, OSINT data sources.
dnsx
GoFast multi-purpose DNS toolkit. Retries, wildcard filtering, and multiple resolver support.
Knock
PythonSubdomain enumeration tool using wordlist and DNS resolution. Supports VirusTotal and zone transfers.
Assetfinder
GoFind domains and subdomains potentially related to a given domain. Pulls from multiple passive sources.
Subjack
GoSubdomain takeover tool. Checks if CNAME records point to deprovisioned cloud services.
Altdns
PythonSubdomain discovery through alterations and permutations. Generates mutated wordlists from known subdomains.