subfinder

A subdomain discovery tool that discovers valid subdomains for websites.

Designed as a passive framework to be useful for bug bounties and safe for penetration testing.

• Find subdomains for a specific domain:

subfinder -d {example.com}

• Show only the subdomains found:

subfinder --silent -d {example.com}

• Use a brute-force attack to find subdomains:

subfinder -d {example.com} -b

• Remove wildcard subdomains:

subfinder -nW -d {example.com}

• Use a given comma-separated list of resolvers:

subfinder -r {8.8.8.8},{1.1.1.1} -d {example.com}

Copyright © 2014—present the tldr-pages team and contributors.

This work is licensed under the Creative Commons Attribution 4.0 International License (CC-BY).