Subfinder

Subfinder

Purpose

Use this skill for quick passive subdomain enumeration early in external discovery.

Phase Fit

• Primary: Discovery and Reconnaissance
• Secondary: Threat Modeling and Test Planning
• Retest use: verify whether deprecated subdomains were removed from exposure

Use When

• Need a fast passive view of likely subdomains.
• Need a seed list for HTTP probing or deeper inventory validation.
• Need to cross-check public exposure against expected holdings.

Avoid When

• Scope is not internet-facing.
• Ownership is uncertain and the output would be treated as confirmed inventory.

Inputs

• Approved domains
• Known brands, business units, and exclusion list

Procedure

1. Collect passive candidates from approved root domains.
2. Remove duplicates and normalize naming.
3. Label unverified entries clearly.
4. Pass reachable-looking hosts to httpx for confirmation.
5. Compare the resulting surface to expected inventory and escalate gaps.

Command Syntax

Replace sample targets with approved in-scope assets.

# Basic passive enumeration
subfinder -d contoso.com -o contoso-subs.txt

# Enumerate from a list of approved domains
subfinder -dL approved-domains.txt -o contoso-all-subs.txt

# Use all configured passive sources
subfinder -d contoso.com -all -o contoso-all.txt

# Silent output piped to httpx for live probing
subfinder -d contoso.com -silent | httpx -silent -o contoso-live.txt

# Verbose output with source tracking
subfinder -d contoso.com -v -o contoso-verbose.txt

# Increase timeout for slow resolvers
subfinder -d contoso.com -timeout 30 -o contoso-subs.txt

Evidence to Capture

• Candidate subdomain list
• Inventory gaps between known and observed exposure
• Domains requiring ownership confirmation

Safety Boundaries

• Treat results as candidate assets until verified.
• Do not expand scope from similar names or adjacent brands without approval.