provocativo_
back to the arsenal
// arsenal·Recon & OSINTBeginnerFOSS

Subfinder

Project Discovery's fast passive-only subdomain enumerator.

Recon & OSINT

$ subfinder --help

Subfinder

// what it is

Description

Go binary from the ProjectDiscovery team. Pure passive (so safe to run against any target), parallel, and pluggable into the rest of the PD toolchain (dnsx, httpx, nuclei).

// use cases

What people use it for

  • Quick subdomain enumeration without touching the target
  • Pipeline input to httpx, dnsx, nuclei

// commands

The commands you'll type

Default enumeration

$ subfinder -d target.tld -all

Pipeline

$ subfinder -d target.tld | dnsx -resp | httpx -status-code

// facts

category
Recon & OSINT
platforms
LIN · WIN · MAC
license
FOSS
difficulty
Beginner

// related in Recon & OSINT