# Subfinder

> Auth/lab ref: Passive subdomain enumeration tool using 40+ OSINT sources.

- Skill: `aeondave/subfinder` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aeondave/subfinder`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/subfinder/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/subfinder

---


# Subfinder

Fast passive subdomain enumeration — part of the ProjectDiscovery toolkit.

## Quick Start

```bash
# Enumerate subdomains for a domain
subfinder -d example.com

# Output to file
subfinder -d example.com -o subs.txt

# Silent mode (subdomains only, no banner)
subfinder -d example.com -silent
```

## Core Flags

| Flag | Description |
|------|-------------|
| `-d <domain>` | Target domain |
| `-dL <file>` | List of domains from file |
| `-o <file>` | Output file |
| `-oJ` | JSON output |
| `-silent` | Print subdomains only |
| `-t <n>` | Threads (default 10) |
| `-timeout <n>` | Timeout per source (seconds) |
| `-all` | Use all sources (slower, more results) |
| `-recursive` | Enumerate recursively |
| `-active` | Active DNS verification of results |
| `-v` | Verbose output |

## Provider Configuration

Configure API keys in `~/.config/subfinder/provider-config.yaml`:

```yaml
shodan:
  - YOUR_SHODAN_KEY
virustotal:
  - YOUR_VT_KEY
censys:
  - YOUR_CENSYS_ID:YOUR_SECRET
binaryedge:
  - YOUR_KEY
```

Without API keys, subfinder still uses free sources (crt.sh, hackertarget, etc.).

## Common Workflows

```bash
# Enumerate + pipe to httpx for live host check
subfinder -d example.com -silent | httpx -silent

# Recursive enumeration
subfinder -d example.com -recursive -silent -o all_subs.txt

# Multiple domains from file
subfinder -dL domains.txt -silent -o subs.txt

# Use all sources for maximum coverage
subfinder -d example.com -all -silent

# JSON output for automation
subfinder -d example.com -oJ -o subs.json
```

## Full Recon Pipeline

```bash
# Subdomain → live hosts → web fingerprint → screenshot
subfinder -d target.com -silent -all | \
  dnsx -silent -a -resp | \
  awk '{print $1}' | \
  httpx -silent -status-code -title -tech-detect | \
  tee web_services.txt

# Find admin/login panels in results
grep -iE "admin|login|portal|dashboard|manage" web_services.txt
```

## Resources

| File | When to load |
|------|--------------|
| `references/providers.md` | Full passive source list, API key setup for all 40+ providers |