subfinder
subfinder is a free passive subdomain discovery tool used to enumerate valid subdomains from online sources for bug bounty hunters and recon teams.
0 upvotes · 0 downvotes
No ratings yet
- Category
- OSINT & Reconnaissance
- Pricing
- Free
- Platforms
- WindowsmacOSLinux
- License
- Open source
- Reviewed
- Last reviewed 6 October 2026
What it is
A fast command line scanner that queries many passive data sources to collect subdomains for a target domain, then resolves and cleans the results.
What it helps with
- Gathering subdomains from passive sources without touching the target directly
- Feeding results into other tools through standard input and output
- Pulling from many sources, several of which accept optional API keys
Who it's for
Bug bounty hunters, red teams, and recon analysts mapping the public footprint of domains they are authorized to assess.
Worth knowing
It is also published as a Go library, so the same discovery can be built into other programs.
How is it installed?
It ships through Go, Homebrew, Docker, or a prebuilt binary.
What result formats does it produce?
Plain text or JSON.
Discussion & reviews
0 comments
No contributions yet. Be the first to review or comment.