Subfinder is a passive subdomain enumeration tool from ProjectDiscovery that aggregates data from dozens of public sources without sending a single packet to the target. This makes it an ideal starting point for reconnaissance because it leaves no trace on the target's infrastructure. Subfinder queries certificate transparency logs, search engines, DNS datasets, threat intelligence platforms, and other public repositories to build a comprehensive list of subdomains. This guide covers twenty practical Subfinder commands, explaining what each does and when to apply it during a security assessment.
1. Basic Subdomain Enumeration
subfinder -d example.com
The -d flag specifies the target domain. This is the foundational Subfinder command. It queries all enabled passive sources by default and returns subdomains discovered for the specified domain. No traffic is sent to the target itself.
2. Enumerate Multiple Domains
subfinder -d example.com -d example.org -d example.net
Multiple -d flags can be chained to enumerate several domains in a single run. This is useful when assessing an organization that owns multiple primary domains or when scoping a bug bounty program that includes several root domains.
3. Read Domains from a File
subfinder -dL domains.txt
The -dL flag reads a list of domains from a file, one per line. This scales enumeration across large scopes such as a bug bounty program with dozens of in-scope root domains. Each domain is processed independently.
4. Enumerate from Standard Input
cat domains.txt | subfinder -silent
The -silent flag suppresses the banner and progress indicators, showing only results. Piping from standard input is the most common pattern in recon pipelines, allowing Subfinder to sit alongside tools like httpx and dnsx without intermediate files.
5. Write Output to a File
subfinder -d example.com -o subdomains.txt
The -o flag writes results to a file. Always save enumeration results during assessments to maintain an audit trail and to feed subsequent tools without repeating queries. Subfinder appends to the file rather than overwriting it by default.
6. List All Available Sources
subfinder -ls
The -ls flag lists all passive sources Subfinder can query and then exits. This helps you understand the breadth of data sources available and decide whether to include or exclude specific ones based on reliability or rate limits.
7. Use All Sources Including Slow Ones
subfinder -d example.com -all
By default, Subfinder uses a curated set of reliable sources. The -all flag enables every source, including slower and less reliable ones. This increases coverage at the cost of longer run times and occasionally noisier results.
8. Exclude Specific Sources
subfinder -d example.com -es github,crtsh
The -es flag excludes specified sources from the query. This is useful when a source is rate-limited, unreliable, or when you want to avoid a particular data provider. Source names come from the -ls output.
9. Include Only Specific Sources
subfinder -d example.com -s crtsh,virustotal,securitytrails
The -s flag restricts enumeration to a specific list of sources. This is the inverse of -es. Use it when you need results from a known set of high-quality sources quickly.
10. Use API Keys for Premium Sources
subfinder -d example.com -config config.yaml
The -config flag loads a configuration file containing API keys for premium sources such as SecurityTrails, Shodan, Censys, and VirusTotal. Free sources provide substantial coverage, but premium sources often surface subdomains that free sources miss.
11. Set API Key Directly
subfinder -d example.com -provider-config config.yaml
The -provider-config flag loads a separate provider-specific configuration file. This is useful when you want to keep API keys separate from general Subfinder settings for security or organizational reasons.
12. Control Concurrent Sources
subfinder -d example.com -t 20
The -t flag sets the number of concurrent source queries. The default is 10. Higher values speed up enumeration but may trigger rate limiting from sources. Lower values are gentler and more reliable when API limits are tight.
13. Set Request Timeout
subfinder -d example.com -timeout 30
The -timeout flag defines the maximum number of seconds to wait for each source. Increasing the timeout helps when sources are slow. Decreasing it keeps runs short when you are willing to miss slower responses.
14. Enable Recursive Enumeration
subfinder -d example.com -recursive
The -recursive flag uses already discovered subdomains as input for further enumeration. When Subfinder finds dev.example.com, recursion queries passive sources for subdomains of dev.example.com. This reveals deeper levels of the target's infrastructure.
15. Include Subdomains in Output
subfinder -d example.com -o subdomains.txt -cs
The -cs flag includes the source that discovered each subdomain in the output. This helps assess reliability: a subdomain found by multiple independent sources is more likely to be active and genuine.
16. Display Only Subdomains
subfinder -d example.com -silent
The -silent flag removes the banner and progress output, showing only the subdomains themselves. This is the standard mode for scripting and piping into other tools such as httpx or dnsx.
17. Filter Subdomains with Regex
subfinder -d example.com -silent | grep -E "^(admin|dev|staging)\."
While Subfinder does not have a built-in regex filter, piping to grep achieves the same result. Filtering for high-value prefixes such as admin, dev, and staging helps prioritize the most interesting subdomains for further testing.
18. Verbose Output for Debugging
subfinder -d example.com -v
The -v flag enables verbose output showing which sources are being queried and how many results each returns. This is valuable for troubleshooting when enumeration returns fewer results than expected.
19. Collect Statistics
subfinder -d example.com -stats
The -stats flag displays statistics at the end of the run, including the number of queries made, results found, and time taken. This helps benchmark performance and identify bottlenecks when scaling to large scopes.
20. Save Results in JSON Format
subfinder -d example.com -json -o results.json
The -json flag writes output in JSON format. Each line is a complete JSON object containing the subdomain and its source. JSON output integrates cleanly with parsing tools, dashboards, and automated pipelines.
Explore More Tools
For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:
https://github.com/yogsec/Hacking-Tools/
Stay connected for more security content and updates:
Top comments (0)