subfinder: Passive subdomain enumeration tool
Passive subdomain discovery via DNS resolution and validation.
Learn more about Subfinder
Subfinder is a passive subdomain enumeration tool that aggregates subdomain intelligence from multiple online data sources without actively scanning target infrastructure. The tool queries over 30 sources including certificate transparency logs, search engines, and threat intelligence platforms through their respective APIs, then consolidates and deduplicates the discovered subdomains. It implements DNS resolution capabilities to validate discovered subdomains and can optionally resolve their IP addresses while filtering wildcard DNS entries. The architecture supports concurrent source querying with configurable rate limiting and timeouts to balance discovery speed against API restrictions. Subfinder operates as a command-line utility designed for reconnaissance phases of security assessments and continuous subdomain monitoring workflows.
Configurable Passive Sources
Query 40+ curated data sources without touching target infrastructure. Select, exclude, or combine sources individually with per-source rate limits and recursive subdomain filtering capabilities.
Built-in DNS Validation
Automatic resolution and wildcard elimination verify discovered subdomains before output. Supports custom resolver lists to reduce false positives and validate results against actual DNS records.
Pipeline-Native Design
STDIN/STDOUT support enables direct integration with security toolchains. Batch process domain lists with multiple output formats (JSON, plaintext) and YAML-based configuration for reproducible workflows.
package main
import (
"github.com/projectdiscovery/subfinder/v2/pkg/runner"
)
func main() {
options := &runner.Options{
Threads: 10,
Timeout: 30,
Domains: []string{"example.com"},
}
subfinder, _ := runner.NewRunner(options)
subfinder.RunEnumeration()
}See how people are using Subfinder
Related Repositories
Discover similar tools and frameworks used by developers
OpenSSL
C-based cryptographic library implementing TLS, DTLS, and QUIC protocols.
age
Simple, secure file encryption tool and Go library with small keys and UNIX composability.
Fail2Ban
Log-based intrusion prevention via dynamic firewall management.
Sigma
YAML-based detection rules with SIEM query conversion.
DOMPurify
DOM-based XSS sanitizer using native browser parsing.
Related Reading
Guides and comparisons from the Greptile content library
Greptile Ranks #1 on Martian's AI Code Review Benchmark
Greptile ranks #1 on Martian's independent online AI code review benchmark, leading all evaluated tools in F1 score and precision with near-leading recall.
Best AI Code Review Tools for GitLab
Enterprise-grade AI code review tools for GitLab teams. In-depth comparison of accuracy, security, and integration features to accelerate your merge request workflows.
Best Code Review Tools in 2026
The best code review tools in 2026, compared on pricing, features, deployment options, and ideal use cases for teams of any size.
10 Powerful Code Quality Tools That Catch Bugs Before Deployment
We tested 10 code quality tools that catch bugs before production. Detailed comparison with real-world examples, pricing, and ROI analysis for dev teams.