Fast passive subdomain enumeration tool.
Features • Install • Usage • API Setup • Library • Join Discord
subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is built for
doing one thing only - passive subdomain enumeration, and it does that very well.
We have made it to comply with all the used passive source licenses and usage restrictions. The passive model guarantees speed and stealthiness that can be leveraged by both penetration testers and bug bounty hunters alike.
subfinder -hThis will display help for the tool. Here are all the switches it supports.
…Subfinder supports environment variables to specify custom paths for configuration files:
SUBFINDER_CONFIG - Path to config.yaml file (overrides default $CONFIG/subfinder/config.yaml)SUBFINDER_PROVIDER_CONFIG - Path to provider-config.yaml file (overrides default $CONFIG/subfinder/provider-config.yaml)subfinder requires go1.24 to install successfully. Run the following command to install the latest version:
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latestLearn about more ways to install subfinder here: https://docs.projectdiscovery.io/tools/subfinder/install.
subfinder can be used right after the installation, however many sources required API keys to work. Learn more here: https://docs.projectdiscovery.io/tools/subfinder/install#post-install-configuration.
Learn about how to run Subfinder here: https://docs.projectdiscovery.io/tools/subfinder/running.
Subfinder can also be used as library and a minimal examples of using subfinder SDK is available here
subfinder is made with 🖤 by the projectdiscovery team. Community contributions have made the project what it is. See
the THANKS.md file for more details.
Read the usage disclaimer at DISCLAIMER.md and contact us for any API removal.
No open issues yet, or sync has not completed.