subfinder: passive subdomain discovery for pentest recon

subfinder · MIT

subfinder enumerates subdomains passively. It never touches the target: it queries public sources — certificate transparency logs, passive DNS providers, search indexes — and returns the hostnames they already know about. That property is why it is safe to run first, before scope is confirmed and before anything active is authorised.

Install

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Binary releases are published on the repo’s releases page if you would rather not build from source. On Kali and Debian derivatives apt install subfinder also works, though the packaged version lags upstream.

Most passive sources need API keys to be useful. Without them subfinder still runs, but on a fraction of the data:

mkdir -p ~/.config/subfinder
$EDITOR ~/.config/subfinder/provider-config.yaml

Core commands

# one domain, plain host list on stdout
subfinder -d example.com -silent

# JSON lines, with the source that produced each host
subfinder -d example.com -oJ -o subs.jsonl -cs

# many roots at once, all sources, recursive
subfinder -dL roots.txt -all -recursive -o subs.txt

Flags worth knowing: -silent suppresses the banner so the output pipes cleanly, -all enables every configured source (slower, wider), -cs records which source found each host, and -nW drops wildcard results.

Output

With -oJ each line is a JSON object:

{"host":"api.example.com","input":"example.com","source":"crtsh"}

Without it you get one hostname per line, which is what you want when piping straight into dnsx or httpx.

Where it sits in Tandera

subfinder runs in the discovery phase of both recon_web_lite and recon_web_full. It is one of three passive subdomain producers Tandera schedules — findomain and cero are the others — and their results are merged and deduplicated before anything downstream sees them. Running three producers is deliberate: passive sources disagree, and the union is meaningfully larger than any single tool’s output.

Because it is non-intrusive, subfinder is allowed inside recon_web_lite, which is capped at a NonIntrusive risk ceiling.

Using it in a pentest

Passive enumeration is the first thing you do and the last thing you trust. Two habits matter:

Everything it returns is a claim, not an asset. Certificate transparency remembers hostnames that were decommissioned years ago. Resolve the list (dnsx) and probe it (httpx) before you treat any of it as in scope.

Check the results against your scope document before you probe. Passive discovery routinely surfaces hostnames belonging to a different business unit, a partner, or an acquisition that was never in the engagement. Finding them is fine. Scanning them is not.

The standard opening chain:

subfinder -d example.com -silent 
  | dnsx -silent -a -resp 
  | httpx -silent -title -tech-detect -status-code