Offensive Security Researcher & Quantum Cryptography Analyst

Subfinder: Complete Guide to Fast Passive Subdomain Enumeration Using Kali Linux

Abdul Wahab Junaid
Subfinder: Complete Guide to Fast Passive Subdomain Enumeration Using Kali Linux

subfinder is a fast, passive-only subdomain discovery tool developed by ProjectDiscovery (the team behind nuclei, httpx, and naabu). It is written in Go and designed for speed and simplicity — it queries dozens of passive sources (Certificate Transparency logs, public DNS datasets, search engines, and third-party APIs) without ever sending a single packet directly to the target’s own infrastructure, making it extremely stealthy. Subfinder is often used as the first step in ProjectDiscovery’s broader recon pipeline (subfinder → httpx → nuclei).

Installation

# Kali/Debian (pre-installed, or reinstall)
sudo apt update && sudo apt install subfinder -y

# Via Go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Via Docker
docker pull projectdiscovery/subfinder

Verify installation:

subfinder -version

Syntax

subfinder [OPTIONS]

Command-Line Options

FlagDescription
-d, -domain DOMAINTarget domain(s), comma separated
-dL, -list FILEFile containing a list of domains
-o, -output FILEWrite output to a file
-oJ, -jsonOutput results in JSON format
-oD, -output-dir DIRWrite results per-domain into a directory
-allUse all available data sources (including slower ones)
-sourcesList all available/configured data sources
-es, -exclude-sources SOURCEExclude specific sources from the scan
-recursiveEnumerate recursively (nested subdomains) using known patterns
-nW, -activeFilter results to only actively-resolvable hosts
-r, -resolvers FILECustom list of resolvers for resolving discovered hosts
-t, -threads NUMNumber of concurrent threads
-timeout SECTimeout in seconds per source request
-max-time MINMaximum enumeration time in minutes
-v, -verboseVerbose output
-silentShow only subdomain results, no banners/logs
-nc, -no-colorDisable colored output
-statsPrint enumeration statistics at the end
-pc, -provider-config FILECustom provider config file (API keys)
-config FILEFlag config file
-rl, -rate-limit NUMMaximum requests per second
-ipInclude host IP addresses in output
-cs, -collect-sourcesShow which source found each subdomain

Basic Usage

subfinder -d example.com

Expected output:


     _     __ _         _S3  ___
 ____ _| |_ ___ _|  |___ ___ ___
|  _| | . | -_| . |  _| . |  _|
|___|___|___|___|_|_|_| |___|_|
                v2.6.6

www.example.com
mail.example.com
dev.example.com
[INF] Found 3 subdomains for example.com in 4 seconds 271 milliseconds

Practical Examples

Example 1 — Basic passive enumeration

subfinder -d example.com -silent

www.example.com
mail.example.com
dev.example.com

Example 2 — Save results to a file

subfinder -d example.com -o subs.txt -silent

[+] Results saved to subs.txt

Example 3 — Enumerate multiple domains from a list

subfinder -dL domains.txt -silent

www.example.com
api.example.org
mail.example.org

Example 4 — JSON output for scripting/parsing

subfinder -d example.com -oJ -silent

{"host":"www.example.com","input":"example.com","source":"crtsh"}
{"host":"mail.example.com","input":"example.com","source":"virustotal"}

Example 5 — Show source that discovered each subdomain

subfinder -d example.com -collect-sources -silent

www.example.com,crtsh
dev.example.com,alienvault

Example 6 — Use all available sources (slower but more thorough)

subfinder -d example.com -all -silent

www.example.com
dev.example.com
staging.example.com
legacy-portal.example.com

Example 7 — Recursive enumeration

subfinder -d example.com -recursive -silent

www.example.com
api.dev.example.com
v2.api.dev.example.com

Example 8 — Filter to only actively resolvable hosts

subfinder -d example.com -nW -silent

www.example.com
mail.example.com

Example 9 — List all configured passive sources

subfinder -sources

Current list of enabled sources:
alienvault
anubis
bevigil
binaryedge
bufferover
c99
censys
certspotter
chaos
crtsh
digitorus
dnsdb
dnsdumpster
fofa
fullhunt
github
hackertarget
hunter
intelx
passivetotal
quake
robtex
securitytrails
shodan
threatbook
virustotal
waybackarchive
whoisxmlapi
zoomeyeapi

Example 10 — Chaining subfinder into httpx for live host checks

subfinder -d example.com -silent | httpx -silent -status-code

https://www.example.com [200]
https://mail.example.com [401]

Common Use Cases

Automation with Bash

Full ProjectDiscovery-style recon chain:

#!/bin/bash
# subfinder_chain.sh
DOMAIN=$1
subfinder -d "$DOMAIN" -silent -o subs.txt
httpx -l subs.txt -silent -status-code -title -o live_hosts.txt
echo "[+] Live hosts saved to live_hosts.txt"
cat live_hosts.txt

Scheduled diff-based monitoring (cron-friendly):

#!/bin/bash
# subfinder_monitor.sh
DOMAIN=$1
DATE=$(date +%F)
subfinder -d "$DOMAIN" -silent -o "subs_${DATE}.txt"

PREV=$(ls -t subs_*.txt 2>/dev/null | sed -n 2p)
if [ -n "$PREV" ]; then
    NEW=$(comm -13 <(sort "$PREV") <(sort "subs_${DATE}.txt"))
    if [ -n "$NEW" ]; then
        echo "[+] New subdomains found for $DOMAIN:"
        echo "$NEW"
    fi
fi

Tips and Best Practices

Troubleshooting

ProblemCauseFix
Very few subdomains returnedNo API keys configured — Subfinder relying only on free/unauthenticated sourcesAdd API keys to provider-config.yaml for significantly better coverage
[WRN] source timeout messagesA specific data source is slow/unreachableIgnore isolated warnings; use -es to exclude a consistently failing source
Duplicate results across runsNormal — Subfinder does not deduplicate against historical scans by defaultPipe through sort -u or maintain your own diffing logic for monitoring
Rate-limited (HTTP 429) from a sourceFree-tier API quota exceeded for that dayWait for quota reset, or upgrade to a paid API tier for that source
Output includes clearly unrelated/incorrect subdomainsSome passive sources contain stale or third-party misattributed dataCross-verify unexpected results with dig/whois before including in a report

References

Exit mobile version