subfinder

subfinder is a subdomain discovery tool that returns valid subdomains for a target domain by querying passive online sources rather than probing the target directly. It does only passive enumeration, and its README states that it complies with the licenses and usage restrictions of the sources it uses. The passive approach is described as fast and stealthy, which is why penetration testers and bug bounty hunters use it for reconnaissance.

Input is a single domain (-d) or a file of domains (-dL). Source selection is controlled with -s to pick specific sources (e.g. -s crtsh,github), -es to exclude sources, -recursive to use only sources that handle subdomains recursively, and -all to use every source (slower). -ls lists the available sources. Results can be narrowed with match (-m) and filter (-f) flags. Rate limiting works globally (-rl) or per provider (-rls "hackertarget=10/s,shodan=15/s"). Other options include -proxy, custom resolvers (-r, -rL), -timeout, -max-time, and -mr to cap results per source.

Output goes to stdout, to a file (-o), or to a directory when using a list (-oD). JSONL output (-oJ) is supported, and -cs adds the sources that found each result. The -nW/-active flag shows only subdomains that resolve, and -oI adds host IPs in that mode. The tool reads from STDIN and writes to STDOUT, so it can be chained with other tools in a pipeline. Many sources need API keys, which go in a provider-config.yaml file. The config paths can be overridden with the SUBFINDER_CONFIG and SUBFINDER_PROVIDER_CONFIG environment variables. subfinder can also be imported as a Go library, and the repository includes an SDK example.

Installation

# via Go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest