Repolode
Submit
projectdiscovery

projectdiscovery/subfinder

Fast passive subdomain enumeration tool that finds subdomains of a domain using online sources, without sending traffic to the target.

View on GitHubWebsite
Stars
14,737
Forks
1,646
Open issues
3
Last commit
22 hours ago

What is it?

subfinder discovers subdomains for a given domain by querying passive online sources such as certificate transparency logs and search or DNS data providers. Because it does not probe the target directly, enumeration is quick and low-profile, which suits reconnaissance work in penetration testing and bug bounty programs.

The tool is a single Go binary with a modular design and is built to do one task: passive subdomain enumeration. It includes optional wildcard elimination and resolution modules, rate limiting per provider, and filtering by exact names or regular expressions. Results can be written as plain text or JSONL, to a file, or to stdout, and it accepts input from stdin so it can be chained with other tools. Many sources require API keys, which are configured in a provider config file.

subfinder can also be imported as a Go library, allowing other programs to run enumeration through its SDK.

Key features

  • 01Enumerates subdomains using curated passive online sources.
  • 02Supports wildcard elimination and DNS resolution modules.
  • 03Filters results by exact names or regular expressions.
  • 04Applies rate limits per provider.
  • 05Outputs plain text or JSONL to a file or stdout, and reads domains from stdin.

Use cases

  • Mapping the attack surface of a domain during a penetration test.
  • Collecting in-scope subdomains for a bug bounty target.
  • Feeding discovered hosts into other scanning tools via pipes.
  • Embedding subdomain enumeration in custom security tooling through the Go library.

Quick start

  1. 1

    Install subfinder with Go (requires go1.26.10)

    go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
  2. 2

    Run subfinder against a domain

    subfinder -d example.com

Things to know

  • Many passive sources need API keys before they return results.
  • Requires go1.26.10 to install from source.

In collections

CLI & terminal tools

Topics

#subdomain-enumeration#reconnaissance#osint#bug-bounty#security-tools#cli#golang#bugbounty#hacking#hacktoberfest

FAQ

What is subfinder?
Fast passive subdomain enumeration tool that finds subdomains of a domain using online sources, without sending traffic to the target. subfinder discovers subdomains for a given domain by querying passive online sources such as certificate transparency logs and search or DNS data providers. Because it does not probe the target directly, enumeration is quick and low-profile, which suits reconnaissance work in penetration testing and bug bounty programs.
Is subfinder free to use? What license does it have?
subfinder is open source under the MIT license. Check the license terms before using it in commercial products.
Is subfinder still maintained?
Actively maintained. The last commit to subfinder was on Nov 6, 2026.
What can I use subfinder for?
Mapping the attack surface of a domain during a penetration test. Collecting in-scope subdomains for a bug bounty target. Feeding discovered hosts into other scanning tools via pipes. Embedding subdomain enumeration in custom security tooling through the Go library.
How do I install subfinder?
Install subfinder with Go (requires go1.26.10): go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest Run subfinder against a domain: subfinder -d example.com
Where can I get subfinder?
The source code and installation instructions are on GitHub: https://github.com/projectdiscovery/subfinder

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects