R-SUB
subfinder
Passive subdomain discovery tool that aggregates results from dozens of public sources.
OVERVIEW
subfinder is a ProjectDiscovery tool that enumerates subdomains purely from passive sources — certificate transparency logs, public DNS datasets, search engines, and dozens of third-party APIs — without sending any resolution or probing traffic directly at the target's infrastructure.
It's built for speed and pipeline use: results stream out as they're found, can be piped straight into httpx for liveness/fingerprinting or katana for crawling, and API keys for premium sources (e.g. SecurityTrails, Shodan) can be added to widen coverage beyond the free defaults.
USE CASES
Practical use cases
- 01
Building the initial subdomain list for a domain-scoped engagement with zero active traffic.
- 02
Feeding a fresh subdomain list into httpx to find which ones are actually live.
- 03
Widening coverage with API keys for premium sources on longer engagements.
- 04
Re-running periodically during a long engagement to catch newly registered subdomains.
QUICK START
As the first, low-noise step to enumerate subdomains for a domain-scoped engagement, before any active probing.
- Confirm the root domain is inside the agreed scope.
- Install subfinder via Go install or a precompiled release binary.
- Run a passive enumeration pass against the root domain.
- Optionally add API keys in the config file for sources that need them.
- Pipe the output into httpx to confirm which subdomains are actually live.
subfinder -d target.com -silent -o subdomains.txtBEFORE YOU RUN IT
What to check before running it
Being passive, results reflect what third-party sources have indexed, not the current DNS state — some subdomains returned may be stale, renamed, or decommissioned.
Coverage without paid API keys is noticeably narrower than with them; a free-tier run should not be treated as exhaustive.
A discovered subdomain being resolvable doesn't mean it's in scope — always cross-check against the signed scope document, especially with shared or wildcard DNS setups.