subfinder
Fast passive subdomain enumeration that aggregates 30+ public sources. The default first step of almost every recon workflow.
Tags: subdomains, passive, projectdiscovery
- Category
- recon
- Maintenance signal
- active
Project repository · Documentation
Use this when: Intake. First passive host list on a root you are allowed to resolve.
Install
go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latestbrew
brew install subfinderpdtm
pdtm -i subfinderCommand templates
Passive enum → file
subfinder -d {domain} -all -recursive -o {output}Silent (pipe-friendly)
subfinder -d {domain} -all -silent