Recon
Enumerate a domain's subdomains from passive sources
A subdomain discovery tool that finds valid subdomains using passive online sources.
overview
What subfinder does
subfinder enumerates a domain's subdomains by querying passive sources such as certificate transparency logs, DNS aggregators, and threat-intelligence feeds, rather than brute forcing names. That makes it fast and quiet: it builds a broad map of an organization's footprint without sending traffic to the targets themselves.
Its modular architecture is built for one job and does it well. Pull from all sources for maximum coverage or a chosen few for speed, set per-provider rate limits, and emit JSONL so every result is a structured record. Active mode resolves the names and reports only the subdomains that are live.
On Trickest, subfinder is a Recon node that takes a domain or a list of domains and writes a file and a folder of names. It is the usual first node in an attack-surface workflow; pass its output to httpx to find which subdomains respond, and schedule it for continuous monitoring.
use cases
Where subfinder fits
Map an organization's footprint
Enumerate every subdomain of a domain from passive sources to scope an engagement or build an asset inventory.
Feed a probing and scanning pipeline
Hand discovered subdomains to httpx and a scanner so the rest of the workflow runs against the full surface.
Monitor for new subdomains
Run subfinder on a schedule and diff results to catch newly exposed assets as they go live.
Enumerate many domains at once
Supply a file of domains for bulk discovery and write the combined name list for downstream nodes.
reference
subfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -domain | Domains to find subdomains for (comma-separated). |
| list | FILE | -list | File containing a list of domains for bulk discovery. |
| json | BOOLEAN | -json | Write output in JSONL format. |
| all | BOOLEAN | -all | Use all sources for enumeration (slow). |
| active | BOOLEAN | -active | Display active subdomains only. |
| match | STRING | -match | Subdomain or list of subdomains to match (comma-separated). |
| rate-limit | STRING | -rate-limit | Maximum HTTP requests to send per second (global). |
| sources | STRING | -sources | Specific sources to use for discovery (-s crtsh,github). |
Showing key inputs. subfinder exposes 30 inputs in total.
Full flag reference (30 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| ip | BOOLEAN | -ip | include host IP in output (-active only) |
| all | BOOLEAN | -all | use all sources for enumeration (slow) |
| json | BOOLEAN | -json | write output in JSONL(ines) format |
| list | FILE | -list | file containing list of domains for subdomain discovery |
| match | STRING | -match | subdomain or list of subdomain to match (comma separated) |
| proxy | STRING | -proxy | http proxy to use with subfinder |
| stats | BOOLEAN | -stats | report source statistics |
| active | BOOLEAN | -active | display active subdomains only |
| config | FILE | -config | flag config file |
| domain | STRING | -domain | domains to find subdomains for (comma separated) |
| filter | STRING | -filter | subdomain or list of subdomain to filter (comma separated) |
| silent | BOOLEAN | -silent | show only subdomains in output |
| sources | STRING | -sources | specific sources to use for discovery (-s crtsh,github). |
| threads | STRING | -t | number of concurrent goroutines for resolving (-active only) (default 10) |
| timeout | STRING | -timeout | seconds to wait before timing out (default 30) |
| verbose | BOOLEAN | -v | show verbose output |
| max-time | STRING | -max-time | minutes to wait for enumeration results (default 10) |
| no-color | BOOLEAN | -no-color | disable color in output |
| recursive | BOOLEAN | -recursive | use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld) |
| resolvers | STRING | -r | comma separated list of resolvers to use |
| exclude-ip | BOOLEAN | -exclude-ip | exclude IPs from the list of domains |
| match-file | FILE | -match | subdomain or list of subdomain to match |
| rate-limit | STRING | -rate-limit | maximum number of http requests to send per second (global) |
| filter-file | FILE | -filter | subdomain or list of subdomain to filter |
| rate-limits | STRING | -rate-limits | maximum number of http requests to send per second four providers in key=value format (-rls hackertarget=10/m) (default ["github=30/m", "fullhunt=60/m", "robtex=18446744073709551615/ms", "securitytrails=1/s", "shodan=1/s", "virustotal=4/m", "hackertarget=2/s", "waybackarchive=15/m", "whoisxmlapi=50/s"]) |
| resolvers-list | FILE | -rlist | file containing list of resolvers to use |
| collect-sources | BOOLEAN | -collect-sources | include all sources in the output (-json only) |
| exclude-sources | STRING | -exclude-sources | sources to exclude from enumeration (-es alienvault,zoomeyeapi) |
| provider-config | FILE | -provider-config | provider config file |
| disable-update-check | BOOLEAN | -disable-update-check | disable automatic subfinder update check |
example
Run subfinder
# passive enumeration across all sources, quiet outputsubfinder -d example.com -all -silent -o subdomains.txtapi.example.comapp.example.comstaging.example.comdev.example.commail.example.comvpn.example.comgitlab.example.comgrafana.example.comhive-api.dev.example.comwww.staging.example.com… (53 hosts found for the real run behind this page)guidance
Choosing subfinder
Use subfinder for fast, passive subdomain discovery at the start of a workflow. For active DNS brute forcing of a wordlist, pair it with subbrute. It finds names, it does not test them, so follow it with httpx to learn which subdomains are live.
amass
Deeper, slower OSINT with active options. subfinder is quicker for a passive first pass.
assetfinder
Lighter passive finder. subfinder queries more sources for broader coverage.
workflows
Workflows using subfinder
Audit SSH algorithms on port 22
Enumerate a domain and flag weak SSH host keys, key exchange, ciphers, and MACs from an unauthenticated banner. The check does not log in.
Audit TLS certificates on port 443
Enumerate a domain and classify expired, mismatched, self-signed, and untrusted certificates on port 443. The check reads the handshake only.
Check Email Spoofing (DMARC SPF DKIM)
Check whether an attacker can send mail as your domain by querying SPF, DKIM, DMARC, MTA-STS and BIMI across every subdomain.
Domain OSINT & Footprinting
Profile a domain without sending it a packet: subdomains, DNS, WHOIS and certificate history, plus which hosts are live and what they run.
Exposed MCP Server Scanner
Scan a target domain with subfinder and httpx for MCP servers, then write authentication, capability, and poisoning-risk findings to JSONL.
Find exposed admin and management panels
Enumerate a domain and confirm admin panels such as Tomcat Manager, Jenkins, and phpMyAdmin from page markers or auth realms.
Find exposed API and debug surfaces
Enumerate a domain and confirm exposed OpenAPI specs, Spring Actuator endpoints, and debug paths from response content, not from a bare HTTP 200.
Find exposed DevOps config files
Enumerate a domain and confirm web-exposed Terraform state, Docker config, npmrc, and netrc files from their content, not from a bare HTTP 200.
Find exposed Docker Engine APIs
Enumerate a domain and probe ports 2375 and 2376 for a Docker Engine API that returns version JSON. The check does not run containers.
Find exposed SAP Commerce surfaces
Enumerate a domain and fingerprint SAP Commerce HAC, Backoffice, and Data Hub from public pages. The check does not sign in.
Find Origin IPs Behind Cloudflare
Find the origin server behind Cloudflare or another WAF by resolving subdomains, filtering CDN ranges, and confirming which IP serves the site.
Find Subdomain Takeovers
Find dangling CNAMEs an attacker could claim on your subdomains, with the service behind each record named so you know who to ask.
Fingerprint front-end JS library versions
Enumerate a domain and read public pages for JavaScript library names and versions, including jQuery, AngularJS, Bootstrap, and Lodash.
Multi-Cloud Dangling DNS
Bind AWS, GCP, Azure, and Cloudflare vault config into findmytakeover; emit dangling-DNS findings and an evidence report.
PQ Crypto Surface Scanner
Enumerate live hosts from a domain, fingerprint TLS and post-quantum readiness with AC Scanner, and emit CBOM-style evidence plus remediation.
Subdomain Enumeration
Find every subdomain of a domain from passive sources and certificate transparency, then resolve and probe the hosts that answer.
Website Screenshot & Visual Recon
Screenshot every live web server across a domain's subdomains, ordered so the forgotten dashboard and the staging copy of production surface first.
faq
subfinder questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run subfinder yourself
A domain feeds subfinder, which enumerates subdomains passively and passes them to httpx so only live names land as output.
Facts on this page come from the live Trickest tool library.