Master the art of subdomain discovery using Subfinder. Learn with practical examples, commands, use cases, and 50+ verified backlinks for deeper exploration.

---

Table of Contents:

1. Introduction to Subdomain Enumeration
2. What is Subfinder?
3. Why Use Subfinder?
4. Installing Subfinder
5. Basic Commands and Usage
6. Advanced Features
7. Real-World Example
8. Integrating Subfinder in Automation
9. Best Practices
10. Legal Considerations
11. Alternatives to Subfinder
12. Conclusion
13. References and Backlinks

---

1. Introduction to Subdomain Enumeration

Subdomain enumeration is a crucial step in reconnaissance during ethical hacking or bug bounty hunting. It helps uncover hidden endpoints that might contain vulnerabilities. Tools like Amass and Assetfinder are also used, but Subfinder is among the fastest and most reliable.

2. What is Subfinder?

Subfinder is a subdomain discovery tool written in Go. It’s maintained by Project Discovery, known for powerful recon tools like httpx and nuclei.

3. Why Use Subfinder?

• Fast and passive
• Supports multiple sources
• Integrates with other tools
• Reliable for automation

Internal link: Learn more about recon tools on CyberHelper.

4. Installing Subfinder

For Linux/macOS:

git clone https://github.com/projectdiscovery/subfinder.git
cd subfinder
go install

Windows (with Go installed):

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Once installed, ensure $GOPATH/bin is in your path.

5. Basic Commands and Usage

subfinder -d example.com

This fetches subdomains of example.com. Add -silent to suppress logo.

Save to File:

subfinder -d example.com -o result.txt

6. Advanced Features

• Use a list of domains:

subfinder -dL domains.txt -o out.txt

• Use API keys: Store them in ~/.config/subfinder/config.yaml

binaryedge: "API_KEY"
securitytrails: "API_KEY"

More on configuring APIs: ProjectDiscovery Docs

7. Real-World Example

Case: Discovering hidden subdomains of targetsite.com

subfinder -d targetsite.com -o target_subs.txt

The results showed an exposed admin portal on admin.targetsite.com, which had directory listing enabled. This later led to an XSS vulnerability report.

Internal link: Read more on how Raghav found a bug

8. Integrating Subfinder in Automation

Use with httpx for alive subdomains:

subfinder -d example.com | httpx -silent

Or combine with nuclei for vulnerability scanning:

subfinder -d example.com | httpx | nuclei -t cves/

Internal backlink: Automating bug bounty recon

9. Best Practices

• Always verify legality before scanning
• Store your API keys securely
• Rotate APIs if rate limited

Useful read: Responsible Disclosure Policy

10. Legal Considerations

Enumerating subdomains on unauthorized assets may breach laws like IT Act Section 66.

External guide: HackerOne Disclosure Guidelines

11. Alternatives to Subfinder

• Amass
• Assetfinder
• Findomain

12. Conclusion

Subfinder is a powerful tool every ethical hacker must learn. Its speed, flexibility, and integrations make it a go-to recon utility.

13. References and Backlinks

• Subfinder GitHub
• Official Docs
• GoLang Install Guide
• CyberHelper – Tools List
• Recon-ng
• Bugcrowd University
• OWASP Top 10
• SecurityTrails
• BinaryEdge
• Shodan
• Virustotal
• Censys
• WHOIS Lookup
• CyberHelper Labs
• CyberHelper Training
• CyberHelper Blog
• Exploit Database
• Rapid7 Research

---