AeonDave Subfinder
Fast passive subdomain enumeration — part of the ProjectDiscovery toolkit.
Quick Start
# Enumerate subdomains for a domain
subfinder -d example.com
# Output to file
subfinder -d example.com -o subs.txt
# Silent mode (subdomains only, no banner)
subfinder -d example.com -silent
Core Flags
| Flag | Description |
|---|---|
-d <domain> |
Target domain |
-dL <file> |
List of domains from file |
-o <file> |
Output file |
-oJ |
JSON output |
-silent |
Print subdomains only |
-t <n> |
Threads (default 10) |
-timeout <n> |
Timeout per source (seconds) |
-all |
Use all sources (slower, more results) |
-recursive |
Enumerate recursively |
-active |
Active DNS verification of results |
-v |
Verbose output |
Provider Configuration
Configure API keys in ~/.config/subfinder/provider-config.yaml:
shodan:
- YOUR_SHODAN_KEY
virustotal:
- YOUR_VT_KEY
censys:
- YOUR_CENSYS_ID:YOUR_SECRET
binaryedge:
- YOUR_KEY
Without API keys, subfinder still uses free sources (crt.sh, hackertarget, etc.).
Common Workflows
# Enumerate + pipe to httpx for live host check
subfinder -d example.com -silent | httpx -silent
# Recursive enumeration
subfinder -d example.com -recursive -silent -o all_subs.txt
# Multiple domains from file
subfinder -dL domains.txt -silent -o subs.txt
# Use all sources for maximum coverage
subfinder -d example.com -all -silent
# JSON output for automation
subfinder -d example.com -oJ -o subs.json
Full Recon Pipeline
# Subdomain → live hosts → web fingerprint → screenshot
subfinder -d target.com -silent -all | \
dnsx -silent -a -resp | \
awk '{print $1}' | \
httpx -silent -status-code -title -tech-detect | \
tee web_services.txt
# Find admin/login panels in results
grep -iE "admin|login|portal|dashboard|manage" web_services.txt
Resources
| File | When to load |
|---|---|
references/providers.md |
Full passive source list, API key setup for all 40+ providers |