01 · Product name
Subfinder
Fast passive subdomain discovery from ProjectDiscovery.
Published by ProjectDiscovery.
In short
Subfinder finds subdomains from passive sources. It is a free, open-source CLI from ProjectDiscovery, built to be fast and scriptable. It does not brute force DNS by itself. Some sources return more if you supply API keys. Pair it with Amass when you also need active enumeration or a richer graph.
Product pricing strategy
02
Free
Subfinder is free. You do not buy a seat to use what the project publishes.
Yes. Subfinder is free and open source. A few of its data sources sell API access separately.
Utility and features
03
Subfinder does one job and returns. You pass a domain, it asks passive data sources, and it prints unique names. That makes it the right first command in a pipeline and a poor tool for answering “what else shares this infrastructure?” Amass takes that second question.
- Passive sources. Public datasets and APIs. Coverage changes when a source rate-limits you or when your key is missing.
- Speed. It is built to finish. Use it to get a name list, then decide what deserves a slower tool.
- What it will not do. It will not rank risk, screenshot sites, or prove a name resolves to an asset you own. Those are later steps.
Configure keys for the sources that matter to you — certificate databases often work without one, while a few commercial indexes do not. Output is plain text or JSON, which is why it shows up in shell pipelines. Stay on passive mode unless you have moved to a different tool on purpose. A list of names is not a list of hosts you are allowed to hit with a vulnerability scanner.
- 1
Install a current Subfinder release from ProjectDiscovery.
- 2
Add API keys in its config for sources you are allowed to use.
- 3
Run it on one in-scope domain and save the text output with the date.
- 4
Diff that list against Amass before you treat either as complete.
Caveats
04
Subfinder is a free ProjectDiscovery passive enumerator. It is fast because it asks other people’s APIs, not because it proves a name is live. Some sources need keys. Without them you get a thinner list, not a complete one.
New names can be parked, internal, or out of scope. Resolving and scanning them is a separate, authorized step. Compare with Amass when the list looks short or suspiciously long.
Screenshots
05
Potential use cases
06
- At the start of an authorized assessment, run Subfinder against the primary domain with the sources you configured. You get a fast passive hostname list. Diff it with Amass before you trust either list. A name is a candidate. It is not a target until it is in scope. Do not pipe the output into a vulnerability scanner by habit.
- You re-check a domain on a schedule. Keep the previous list and alert only on names that are new. The output that matters is the delta, with the date. Pivot a new name to certificate transparency or to Shodan if you need a banner, passively. API keys for the passive sources have their own quotas. This listing does not quote them.
- A junior analyst needs to see a small passive collector. One domain, one command, one file of names, then a manual look at five of them in a browser. The lesson is how little a hostname tells you. Amass is the pivot when you need more sources. theHarvester is the pivot when you need emails rather than names.
Hard cases
The case where the first result is easy to over-read.
A new name is an internal hostname that leaked into a cert
The delta contains something like vpn or dev. That is a lead for the asset owner, not an invitation to log in or to brute-force it. Record the name, the date Subfinder saw it, and the source if the tool printed one. Hand it over. Do not add it to an attack queue because it looks interesting.
Questions
Is Subfinder free?
Yes. Subfinder is free and open source. A few of its data sources sell API access separately.
How is Subfinder different from Amass?
Subfinder is a fast passive name collector. Amass also maps relationships and can run active techniques. Many people run both.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Subfinder repository
https://github.com/projectdiscovery/subfinderDocumentation
Subfinder README
https://github.com/projectdiscovery/subfinder/blob/main/README.md