Subfinder
Subfinder is a passive subdomain discovery tool that queries public sources such as certificate transparency and DNS datasets.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- List subdomains of your organisation's domains
- Feed names to httpx for liveness checks
Key features
- Passive sources only
- Configurable API keys for more data
- Pipeline-friendly output
Installation
Install a release binary or via Go; see the docs.
Beginner usage guide
Run against your own domain, then pipe the results into an HTTP probe to see which names serve web pages.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Find subdomains
subfinder -d example.comPrints subdomains found from passive sources for the domain you own.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary subfinder ([[34mINF[0m] Current Version: v2.16.0) on 2026-10-27.