root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat subfinder.md
// recon

Subfinder

21 Jul 2026 · 5 min read
reconcheatsheetssubfinder
subfinder is a passive subdomain enumerator from the ProjectDiscovery arsenal: it queries dozens of public sources (certificates, search engines, DNS databases) without sending direct traffic against the target. It is built for the reconnaissance phase, where it widens the attack surface by discovering hosts that are not visible at first glance.

The key point is that passive does not mean complete: by default subfinder only uses sources that need no key, so the result depends directly on the API keys you configure in config.yaml and on whether you enable -all. It also does not confirm that the subdomains exist: it returns candidates you must later resolve or validate (which is why it fits so well chained with dnsx, httpx, or naabu).

1. Beginner level — basic passive enumeration

SUBFINDER cheat sheet — Beginner
CommandWhat it does
subfinder -d dom.comEnumerates subdomains
subfinder -d dom.com -o subs.txtSaves the output
subfinder -dL domains.txtMultiple domains from a file
subfinder -d dom.com -silentOnly the subdomains (no banner)
subfinder -d dom.com -allUses all sources
subfinder -d dom.com -recursiveRecursive sources
subfinder -d dom.com -sources crtshSpecific source
subfinder -d dom.com -json -o out.jsonOutput in JSON
subfinder -d dom.com -t 50Concurrency
subfinder -d dom.com -timeout 30Timeout per source
subfinder -versionShows the version
subfinder -d dom.com -ipAlso shows the resolved IP
subfinder -lsLists the available sources
subfinder -d dom.com | httpx -silentChains with httpx

2. Advanced level — exhaustiveness and chaining

SUBFINDER cheat sheet — Advanced
CommandWhat it does
subfinder -d dom.com -all -recursive -o subs.txtExhaustive enumeration
subfinder -dL scope.txt -all -o all.txtMulti-domain with all sources
subfinder -d dom.com -es crtshExcludes a source
subfinder -d dom.com -config config.yamlConfig with API keys
subfinder -d dom.com -rl 10Requests-per-second limit
subfinder -d dom.com -proxy http://127.0.0.1:8080Routes through a proxy
subfinder -d dom.com -activeOnly active subdomains (that resolve)
subfinder -d dom.com -ncNo colors
subfinder -d dom.com -oI -o ips.txtSaves only the IPs
subfinder -d dom.com -match subs.txtFilters by a list
subfinder -d dom.com | dnsx -silent -a -respResolves with dnsx
subfinder -d dom.com -all | naabu -silentChains with port scanning
subfinder -d dom.com -statsShows statistics per source
subfinder -d dom.com | httpx -sc -titleFeeds into httpx with status and title

3. Details people miss

  • subfinder's real potential is unlocked with API keys: without configuring them in ~/.config/subfinder/provider-config.yaml, sources like SecurityTrails, Censys, or Shodan stay silent and you lose many subdomains.
  • -all enables every source, including the slow ones and those requiring a key; it is more complete but also noisier and slower, so save it for deep reconnaissance rather than quick sweeps.
  • subfinder only returns passive candidates: it does not check that they resolve. Use -active or chain with dnsx to keep only the live subdomains before attacking them.
  • To avoid blowing through API limits and getting blocked, control the pace with -rl (requests per second) rather than just raising concurrency with -t.
  • When integrating it into pipelines or scripts, use -silent to get only the subdomains (no banner or colors), or -json if you are going to parse the output with another tool.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.