security enabled verified low v1.0.0

subfinder

Fast passive subdomain discovery tool from ProjectDiscovery that queries dozens of online sources to find valid subdomains for target domains.

📋 Live Preview 
subfinder -d {domain} -o {output}
🌍 domain → example.com 🌍 output → subdomains.txt 
subfinder -d {domain} -o {output}

Sandbox: execFile · Timeout: 600s

Capabilities

network.discovery.subdomain
security.recon.passive
network.discovery.dns
network.discovery.dns-resolve

Parameters

Name Type Required Default Description Aliases
flag-d string No - Target domain to find subdomains for -d, -domain
flag-dL file No - File containing list of domains -dL, -list
flag-s string No - Specific sources to use for discovery -s, -sources
flag-es string No - Sources to exclude from enumeration -es, -exclude-sources
all boolean No - Use all sources for enumeration (slow) -all
recursive boolean No - Use only recursive-capable sources -recursive
flag-m string No - Subdomains to match (file or comma separated) -m, -match
flag-f string No - Subdomains to filter (file or comma separated) -f, -filter
flag-rl integer No - Maximum HTTP requests per second -rl, -rate-limit
flag-t integer No 10 Number of concurrent goroutines -t
flag-o string No - File to write output to -o, -output
flag-oJ boolean No - Write output in JSONL format -oJ, -json
flag-oD string No - Directory to write output (-dL only) -oD, -output-dir
flag-nW boolean No - Display active subdomains only -nW, -active
flag-r string No - Comma separated list of resolvers to use -r
silent boolean No - Show only subdomains in output -silent
version boolean No - Show version of subfinder -version
flag-ls boolean No - List all available sources -ls, -list-sources
flag-config file No - Config file path -config
timeout integer No 30 Seconds to wait before timing out -timeout
max-time integer No 10 Minutes to wait for enumeration results -max-time
es boolean No - string[] sources to exclude from enumeration -es, -exclude-sources
f boolean No - string[] subdomain or list of subdomain to filter -f, -filter
ls boolean No - list all available sources -ls, -list-sources
m boolean No - string[] subdomain or list of subdomain to match -m, -match
oD boolean No - only) -oD, -output-dir, -dL
r boolean No - string[] comma separated list of resolvers to use -r
s boolean No - to display all available sources. -s, -sources, -s, -ls
v boolean No - show verbose output -v

Artifacts

TypeDescriptionMIMESchemaTrust
security.recon.subdomain.listList of discovered subdomainstext/plain-verified
security.recon.subdomain.jsonSubdomains in JSONL formatapplication/json-verified

Contract

Inputs

network.target.domain

Target domain name

network.target.domain.list

File containing multiple domains

Outputs

security.recon.subdomain.list

List of discovered subdomains

security.recon.subdomain.json

JSONL output with source metadata

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

security.recon.subdomain.listsecurity.recon.subdomain.json

Consumes

network.target.domainnetwork.target.domain.list

Resource Profile

ResourceValue
CPUlow
Memory64 MB
Networkmedium
Disk I/Olow

Examples

Basic subdomain enumeration for a single domain

subfinder -d example.com

Use all available sources

subfinder -d example.com -all

Save output to a file

subfinder -d example.com -o results.txt

JSON output for pipeline integration

subfinder -d example.com -oJ

Silent mode — only print subdomains

subfinder -d example.com -silent

Use specific sources only

subfinder -d example.com -s crtsh,github

Exclude certain sources

subfinder -d example.com -es alienvault,zoomeyeapi

Rate limit to 10 requests per second

subfinder -d example.com -rl 10

Active subdomain resolution

subfinder -d example.com -nW

Enumerate multiple domains from a file

subfinder -dL domains.txt

List all available data sources

subfinder -ls

Documentation

Subfinder — Passive Subdomain Discovery

Subfinder is a fast passive subdomain enumeration tool from ProjectDiscovery. It queries over 40 online sources including certificate transparency logs, search engines, and threat intelligence platforms to discover valid subdomains without actively probing the target.

Features

  • 40+ passive sources: Certificate transparency, DNS datasets, search engines, APIs
  • Fast and stealthy: No direct contact with target infrastructure
  • Easy integration: STDIN/STDOUT for pipeline workflows
  • Configurable: Per-source rate limiting, source selection, proxy support

Basic Usage

# Standard subdomain enumeration
subfinder -d example.com

# Full results with all sources
subfinder -d example.com -all -oJ

# Pipe to httpx for HTTP probing
subfinder -d example.com -silent | httpx -title -status-code

Related Tools

amassassetfinderdnsenumfiercehttpx

References