$ man subfinder
subfinder
Fast passive subdomain discovery from many public sources.
osint / reconpassive / local only
⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.
## why a developer should care
Combines certificate logs, DNS datasets and search engines into one list of subdomains. Pipe it into httpx to see which ones are alive.
## install
$ go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latestOther platforms and pre-built binaries: official install guide ↗
⚠ The go install command needs Go 1.24+. No Go? Download the binary from the latest release instead.
Check it worked: open a new terminal and run subfinder -version. "command not found" means it isn't installed or isn't on your PATH yet (Go installs to ~/go/bin - add it to PATH).
## shortcuts
# List subdomains
$ subfinder -d {{target}} -silent# List subdomains and save them
$ subfinder -d {{target}} -silent -o subdomains.txt