SubFinder - A Subdomain Discovery Tool That Discovers Valid Subdomains For Websites

Features

• Simple and modular code base making it easy to contribute.
• Fast And Powerful Bruteforcing Module
• Powerful Permutation generation engine. (In Development)
• Many Passive Data Sources (30 At Present)
• Multiple Output formats

Ask, Archive.is, Baidu, Bing, Censys, CertDB, CertSpotter, CrtSH, DnsDB, DNSDumpster, Dogpile, Entrust CT-Search, Exalead, FindSubdomains, GoogleTER, Hackertarget, IPv4Info, Netcraft, PassiveTotal, PTRArchive, Riddler, SecurityTrails, SiteDossier, Shodan, SSL Certificates, ThreatCrowd, ThreatMiner, Virustotal, WaybackArchive, Yahoo 

Usage
This will display help for the tool. Here are all the switches it supports.

Flag	Description	Example
-b	Use bruteforcing to find subdomains	./subfinder -d example.com -b
-c	Don't show colored output	./subfinder -c
-d	Domain to find subdomains for	./subfinder -d example.com
-dL	List of domains to find subdomains for	./subfinder -dl hosts.txt
-nW	Remove wildcard subdomains	./subfinder -nw
-o	Name of the output file (Optional)	./subfinder -o output.txt
-oT	Write output in Aquatone style JSON format (Required -nW)	./subfinder -o output.txt -nw -oA
-oJ	Write output in JSON format	./subfinder -o output.json -oJ
-oD	Output to directory (When using multiple hosts)	./subfinder -od ~/misc/out/
-r	Comma-separated list of resolvers to use	./subfinder -r 8.8.8.8,1.1.1.1
-rL	File containing list of resolvers to use	./subfinder -rL resolvers.txt
--recursive	Use recursive subdomain finding (default: true)	./subfinder --recursive
--set-config	Sets a configuration option	./subfinder --set-config example=something
--set-settings	Sets a setting option	./subfinder --set-settings CensysPages=10
--no-passive	Do not perform passive subdomain enumeration	./subfinder -d freelancer.com --no-passive
--silent	Show only the subdomains found	./subfinder --silent
--sources	Comma separated list of sources to use (optional)	./subfinder --sources threatcrowd,virustotal
--exclude-sources	Comma separated list of sources not to use (optional)	./subfinder --exclude-sources threatcrowd,virustotal
-t	Number of concurrent threads (Bruteforce)	./subfinder -t 10
--timeout	Seconds to wait until quitting connection	./subfinder --timeout 10
-v	Display verbose output	./subfinder -v
-w	Wordlist for doing bruteforcing and permutation	./subfinder -w words.txt

Installation Instructions

Direct Installation

SubFinder requires go1.10+ to install successfully !
The installation is easy. Git clone the repo and run go build.

Upgrading
If you wish to upgrade the package you can use:

Running in a Docker Container
Git clone the repo, then build and run subfinder in a container with the following commands

• Clone the repo using git clone https://github.com/subfinder/subfinder.git
• Build your docker container

• After building the container, run the following.

The above command is the same as running -h

NOTE: Please follow the Post Install steps given after this to correctly configure the tool.
For example, this runs the tool against uber.com and output the results to your host file system:

Post Installation Instructions
Subfinder will work after using the installation instructions however to configure Subfinder to work with certain services, you will need to have setup API keys. These following services do not work without an API key:

• Virustotal
• Passivetotal
• SecurityTrails
• Censys
• Riddler
• Shodan

These are the configuration options you have to specify via the command line.
Theses values are stored in the $HOME/.config/subfinder/config.json file which will be created when you run the tool for the first time. To configure the services to use an API key, you need to use the tool with --set-config option which will allow you to set a configuration option. For example:
If you are using docker, you need to first create your directory structure holding subfinder configuration file. You can either run the binary in your host system and let it create the directory structure of files, after which you can use --set-config flag to set the api values like before. Or you can run:
After that, you can pass it as a volume using the following sample command.
Now, you can also pass --set-config inside the docker to change the configuration options.

Running Subfinder
To run the tool on a target, just use the following command.
This will run the tool against freelancer.com. There are a number of configuration options that you can pass along with this command. The verbose switch (-v) can be used to display verbose information.
The -o command can be used to specify an output file.
You can also get output in json format using -oJ switch. The --silent switch can be used to show only subdomains found without any other info. The --set-config switch can be used to set the value of any configuration option as explained above in the readme.
You can also pass some special settings for the tool through the command line by using --set-setting flag. For example, you can pass the number of Censys pages to check using the following command.
For checking all pages returned by censys, you can use "all" option. Note, It is a string.
These are the settings currently supported
For using bruteforcing capabilities, you can use -b flag with -w option to specify a wordlist.
You can also write output in JSON format as used by Aquatone.
You can specify custom resolvers too.
If you want to do bruteforce only and do not want to run the passive subdomain discovery engine, you can use --no-passive flag which will not run passive discovery. You can use this functionality to run plain bruteforce, etc.