subfinder
Command-line tool that finds subdomains of a website using passive online sources.
- Stars
- 14.7k
- Forks
- 1.6k
- Licence
- MIT
- Language
- Go
- Last update
- 4 days ago
- Type
- CLI
What it is
Subfinder is a command-line tool that lists subdomains for a given website, such as finding blog.example.com or api.example.com for example.com. It works passively, meaning it queries online data sources rather than directly probing the target's servers. The README describes it as fast, lightweight, and built to do this one job well.
- Run subfinder -d example.com to list subdomains of a domain
- Pass a file of domains with -dL to process many targets at once
- Filter results with -match or -filter, or with regular expressions via -match-regex and -filter-regex
- Output results as JSON with -oJ or save them to a file with -o
- Use -active to show only subdomains that resolve, optionally with IPs via -oI
Great for
- Security testers doing reconnaissance on a domain they are authorized to test
- Bug bounty hunters mapping a target's subdomains
- Researchers doing OSINT on an organization's public internet footprint
- Developers who want a quick list of their own domain's subdomains
Not ideal for
- People who need a full scanner that checks for vulnerabilities, since the README describes only subdomain discovery
- Users who need results without any API keys, because the README says many sources require API keys to work well
- Non-technical users who are not comfortable with a terminal
How to get it
- 1
Install with a package manager
You'll need: Go go1.26.10
Install latest version with Go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest - 2
Run it
- Install with the go install command above
- Optionally add API keys to the provider config file, following the linked docs
- Run subfinder -d example.com using a domain you are authorized to research
- Add -silent to show only subdomains, or -oJ for JSON output
- 3
Get the most out of it
- Add API keys in the provider config to unlock more sources, as the README notes many need them
- Use -all for broader enumeration, noting the README says it is slow
- Use -rl or -rls to set per-provider rate limits and respect source limits
- Use -recursive to restrict to sources that handle subdomains of subdomains
- Set SUBFINDER_CONFIG or SUBFINDER_PROVIDER_CONFIG to keep config files in custom locations
Downloads
Strengths
- Uses passive sources, so it does not directly contact the target's servers, per the README
- Supports multiple output formats including JSON, file, and stdout, and works with pipes
- Has built-in filtering and rate-limit controls
Trade-offs
- Many sources need API keys, so results are fuller after setup
- Requires go1.26.10 to install from source according to the README, and the README gives no prebuilt install path beyond the linked docs
- Passive sources are third-party data, so results may be incomplete or stale
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| subfinder (this) | 14.7k | CLI | intermediate | 4 days ago | Security testers doing reconnaissance on a domain they are authorized to test |
| sherlock | 95.4k | CLI | intermediate | 4 days ago | Security researchers doing authorized open-source intelligence work |
| httpx | 10.6k | CLI | intermediate | 4 days ago | Security testers doing reconnaissance on lists of hosts they are authorized to test |
| awesome-hacker-search-engines | 11.5k | Curated list | beginner | 4 days ago | Security professionals starting a penetration test or vulnerability assessment who need a place to look up data |
| OSINT-Framework | 12.4k | Learning resource | beginner | 6 days ago | Researchers looking for a starting point to find free public-information tools |
| HackBrowserData | 14.7k | CLI | intermediate | 4 days ago | Security researchers studying how browsers store local data |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.