projectdiscovery/subfinder

Health v2 · maintenance only

Adoption not part of the score

14315 stars · 1611 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Subfinder is a fast, passive subdomain discovery tool written in Go that enumerates valid subdomains for target domains using online passive sources. It is designed for penetration testers and bug bounty hunters, with a modular architecture, STDIN/STDOUT support, and multiple output formats for easy pipeline integration.

Use cases

• enumerate subdomains of a domain for reconnaissance
• find subdomains for bug bounty targets
• passive OSINT subdomain discovery without touching the target
• build automated recon pipelines with stdin/stdout
• monitor an organization's external attack surface for new subdomains
• feed discovered subdomains into vulnerability scanners like httpx or nuclei

When to choose

• you need fast, stealthy passive subdomain enumeration without sending traffic to the target
• you want a lightweight CLI that integrates into shell pipelines and automation workflows
• you're a bug bounty hunter or pentester doing initial reconnaissance
• you need JSON or plain-text output for downstream tooling

When to avoid

• you need active subdomain brute-forcing or DNS resolution at scale - use tools like puredns or shuffledns instead
• you want a full attack surface management platform with continuous monitoring - consider ProjectDiscovery Neo or similar commercial offerings
• you need web application discovery and content crawling rather than just hostname enumeration

Facets

cli-tool · maturity active

osint security cli developer-tools security osint penetration-testing windows go cli cross-platform subdomain-enumeration reconnaissance bug-bounty passive-recon attack-surface command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="projectdiscovery/subfinder")