# subfinder

> Passive subdomain enumeration tool written in Go that queries online sources, with JSON output, wildcard elimination, and STDIN/STDOUT support.

Stars: 14.7k · Language: Go · License: MIT · Categories: Network

- Repository: https://github.com/projectdiscovery/subfinder
- Website: https://projectdiscovery.io
- Page: https://www.trmn.sh/tools/subfinder

## Install

- Go: `go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest`

## Overview

subfinder is a subdomain discovery tool that returns valid subdomains for a target domain by querying passive online sources rather than probing the target directly. It does only passive enumeration, and its README states that it complies with the licenses and usage restrictions of the sources it uses. The passive approach is described as fast and stealthy, which is why penetration testers and bug bounty hunters use it for reconnaissance.

Input is a single domain (-d) or a file of domains (-dL). Source selection is controlled with -s to pick specific sources (e.g. -s crtsh,github), -es to exclude sources, -recursive to use only sources that handle subdomains recursively, and -all to use every source (slower). -ls lists the available sources. Results can be narrowed with match (-m) and filter (-f) flags. Rate limiting works globally (-rl) or per provider (-rls "hackertarget=10/s,shodan=15/s"). Other options include -proxy, custom resolvers (-r, -rL), -timeout, -max-time, and -mr to cap results per source.

Output goes to stdout, to a file (-o), or to a directory when using a list (-oD). JSONL output (-oJ) is supported, and -cs adds the sources that found each result. The -nW/-active flag shows only subdomains that resolve, and -oI adds host IPs in that mode. The tool reads from STDIN and writes to STDOUT, so it can be chained with other tools in a pipeline. Many sources need API keys, which go in a provider-config.yaml file. The config paths can be overridden with the SUBFINDER_CONFIG and SUBFINDER_PROVIDER_CONFIG environment variables. subfinder can also be imported as a Go library, and the repository includes an SDK example.

### Installation

```bash
# via Go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
```

![subfinder running in a terminal](https://media.trmn.sh/cached/d3b38054f65a1098bf62d6303f95e9acbd1ce06c2f864c2f641f32546188deab.png)

## Alternatives

- [Gobuster](https://www.trmn.sh/tools/gobuster.md): Go-based brute-forcing tool for web directories/files, DNS subdomains, virtual hosts, S3/GCS buckets, TFTP files, and custom fuzzing. (Go, 14.3k stars)
- [katana](https://www.trmn.sh/tools/katana.md): Go-based web crawler from ProjectDiscovery with standard and headless Chrome modes, JavaScript endpoint parsing, scope control, and JSON output for pipelines. (Go, 17.8k stars)
- [wuzz](https://www.trmn.sh/tools/wuzz.md): Interactive terminal UI for inspecting and editing HTTP requests and responses, with cURL-style arguments and regex, HTML and JSON response filtering. (Go, 10.7k stars)
- [httpx](https://www.trmn.sh/tools/httpx.md): HTTP probing CLI from ProjectDiscovery that takes hosts, URLs or CIDRs and reports status, title, TLS, tech stack, CDN and more, with matchers and filters. (Go, 10.6k stars)
- [qrcp](https://www.trmn.sh/tools/qrcp.md): Go CLI that transfers files between a computer and a mobile device over Wi-Fi by printing a QR code in the terminal that links to a temporary local web server. (Go, 10.5k stars)

---

Canonical: https://www.trmn.sh/tools/subfinder