# Subfinder

> Use for fast passive subdomain enumeration during authorized external reconnaissance. Trigger on internet-facing scope, domain seed lists, public exposure review, and subdomain inventory validation.

- Skill: `timsonner/subfinder` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/subfinder`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/subfinder/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/subfinder

---


# Subfinder

## Purpose

Use this skill for quick passive subdomain enumeration early in external discovery.

## Phase Fit

- Primary: Discovery and Reconnaissance
- Secondary: Threat Modeling and Test Planning
- Retest use: verify whether deprecated subdomains were removed from exposure

## Use When

- Need a fast passive view of likely subdomains.
- Need a seed list for HTTP probing or deeper inventory validation.
- Need to cross-check public exposure against expected holdings.

## Avoid When

- Scope is not internet-facing.
- Ownership is uncertain and the output would be treated as confirmed inventory.

## Inputs

- Approved domains
- Known brands, business units, and exclusion list

## Procedure

1. Collect passive candidates from approved root domains.
2. Remove duplicates and normalize naming.
3. Label unverified entries clearly.
4. Pass reachable-looking hosts to `httpx` for confirmation.
5. Compare the resulting surface to expected inventory and escalate gaps.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Basic passive enumeration
subfinder -d contoso.com -o contoso-subs.txt

# Enumerate from a list of approved domains
subfinder -dL approved-domains.txt -o contoso-all-subs.txt

# Use all configured passive sources
subfinder -d contoso.com -all -o contoso-all.txt

# Silent output piped to httpx for live probing
subfinder -d contoso.com -silent | httpx -silent -o contoso-live.txt

# Verbose output with source tracking
subfinder -d contoso.com -v -o contoso-verbose.txt

# Increase timeout for slow resolvers
subfinder -d contoso.com -timeout 30 -o contoso-subs.txt
```

## Evidence to Capture

- Candidate subdomain list
- Inventory gaps between known and observed exposure
- Domains requiring ownership confirmation

## Safety Boundaries

- Treat results as candidate assets until verified.
- Do not expand scope from similar names or adjacent brands without approval.