subfinder
Subfinder is a subdomain discovery tool that discovers valid subdomains for websites by using passive online sources. It has a simple modular architecture and is optimized for speed. Subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.
Details
Category: Recon
Publisher: trickest
Created Date: 6/23/2021
Container: quay.io/trickest/subfinder:v2.6.6
Source URL: https://github.com/projectdiscovery/subfinder
Parameters
ip
boolean
Command:
-ip
- include host IP in output (-active only)all
boolean
Command:
-all
- use all sources for enumeration (slow)json
boolean
Command:
-json
- write output in JSONL(ines) formatlist
file
Command:
-list
- file containing list of domains for subdomain discoverymatch
string
Command:
-match
- subdomain or list of subdomain to match (comma separated)proxy
string
Command:
-proxy
- http proxy to use with subfinderstats
boolean
Command:
-stats
- report source statisticsactive
boolean
Command:
-active
- display active subdomains onlyconfig
file
Command:
-config
- flag config filedomain
string
requiredCommand:
-domain
- domains to find subdomains for (comma separated)filter
string
Command:
-filter
- subdomain or list of subdomain to filter (comma separated)silent
boolean
Command:
-silent
- show only subdomains in outputsources
string
Command:
-sources
- specific sources to use for discovery (-s crtsh,github).threads
string
Command:
-t
- number of concurrent goroutines for resolving (-active only) (default 10)timeout
string
Command:
-timeout
- seconds to wait before timing out (default 30)verbose
boolean
Command:
-v
- show verbose outputmax-time
string
Command:
-max-time
- minutes to wait for enumeration results (default 10)no-color
boolean
Command:
-no-color
- disable color in outputrecursive
boolean
Command:
-recursive
- use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)resolvers
string
Command:
-r
- comma separated list of resolvers to useexclude-ip
boolean
Command:
-exclude-ip
- exclude IPs from the list of domainsmatch-file
file
Command:
-match
- subdomain or list of subdomain to matchrate-limit
string
Command:
-rate-limit
- maximum number of http requests to send per second (global)filter-file
file
Command:
-filter
- subdomain or list of subdomain to filterrate-limits
string
Command:
-rate-limits
- maximum number of http requests to send per second four providers in key=value format (-rls hackertarget=10/m) (default [github=30/m, fullhunt=60/m, robtex=18446744073709551615/ms, securitytrails=1/s, shodan=1/s, virustotal=4/m, hackertarget=2/s, waybackarchive=15/m, whoisxmlapi=50/s])resolvers-list
file
Command:
-rlist
- file containing list of resolvers to usecollect-sources
boolean
Command:
-collect-sources
- include all sources in the output (-json only)exclude-sources
string
Command:
-exclude-sources
- sources to exclude from enumeration (-es alienvault,zoomeyeapi)provider-config
file
Command:
-provider-config
- provider config filedisable-update-check
boolean
Command:
-disable-update-check
- disable automatic subfinder update check