Performing Subdomain Enumeration with Subfinder

When to Use

• During the reconnaissance phase of penetration testing or bug bounty hunting
• When mapping the external attack surface of a target organization
• Before performing vulnerability scanning on discovered subdomains
• When building an asset inventory for continuous security monitoring
• During red team engagements requiring passive information gathering

Prerequisites

• Go 1.21+ installed for building from source
• Subfinder v2 installed (go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest)
• API keys configured for passive sources (Shodan, Censys, VirusTotal, SecurityTrails, Chaos)
• Provider configuration file at $HOME/.config/subfinder/provider-config.yaml
• Network access to passive DNS and certificate transparency sources
• httpx or httprobe for validating discovered subdomains

Workflow