# subfinder: passive subdomain discovery for pentest recon

> How to install and run subfinder, what its JSON output contains, and how Tandera uses it in the discovery phase of web recon.

`subfinder` enumerates subdomains passively. It never touches the target: it queries public sources — certificate transparency logs, passive DNS providers, search indexes — and returns the hostnames they already know about. That property is why it is safe to run first, before scope is confirmed and before anything active is authorised.

## Install

```bash
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
```

Binary releases are published on the repo's releases page if you would rather not build from source. On Kali and Debian derivatives `apt install subfinder` also works, though the packaged version lags upstream.

Most passive sources need API keys to be useful. Without them subfinder still runs, but on a fraction of the data:

```bash
mkdir -p ~/.config/subfinder
$EDITOR ~/.config/subfinder/provider-config.yaml
```

## Core commands

```bash
# one domain, plain host list on stdout
subfinder -d example.com -silent

# JSON lines, with the source that produced each host
subfinder -d example.com -oJ -o subs.jsonl -cs

# many roots at once, all sources, recursive
subfinder -dL roots.txt -all -recursive -o subs.txt
```

Flags worth knowing: `-silent` suppresses the banner so the output pipes cleanly, `-all` enables every configured source (slower, wider), `-cs` records which source found each host, and `-nW` drops wildcard results.

## Output

With `-oJ` each line is a JSON object:

```json
{"host":"api.example.com","input":"example.com","source":"crtsh"}
```

Without it you get one hostname per line, which is what you want when piping straight into `dnsx` or `httpx`.

## Where it sits in Tandera

subfinder runs in the **discovery** phase of both `recon_web_lite` and `recon_web_full`. It is one of three passive subdomain producers Tandera schedules — `findomain` and `cero` are the others — and their results are merged and deduplicated before anything downstream sees them. Running three producers is deliberate: passive sources disagree, and the union is meaningfully larger than any single tool's output.

Because it is non-intrusive, subfinder is allowed inside `recon_web_lite`, which is capped at a `NonIntrusive` risk ceiling.

## Using it in a pentest

Passive enumeration is the first thing you do and the last thing you trust. Two habits matter:

**Everything it returns is a claim, not an asset.** Certificate transparency remembers hostnames that were decommissioned years ago. Resolve the list (`dnsx`) and probe it (`httpx`) before you treat any of it as in scope.

**Check the results against your scope document before you probe.** Passive discovery routinely surfaces hostnames belonging to a different business unit, a partner, or an acquisition that was never in the engagement. Finding them is fine. Scanning them is not.

The standard opening chain:

```bash
subfinder -d example.com -silent \
  | dnsx -silent -a -resp \
  | httpx -silent -title -tech-detect -status-code
```

---

Canonical: https://tandera.io/tools/subfinder
This page as markdown: https://tandera.io/tools/subfinder.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.