Subfinder Tutorial: Subdomain Enumeration for Bug Bounty Hunters

Subdomain discovery is an important part of web application security testing. Before testing an application for vulnerabilities, a penetration tester needs to understand which domains, subdomains, APIs, and web services belong to the target. A Subfinder tutorial helps beginners and experienced bug hunters learn how to automate this process using a fast passive reconnaissance tool.

Subfinder is an open-source tool developed by ProjectDiscovery. It discovers subdomains by collecting information from public sources, including certificate transparency data, passive DNS services, and other supported providers. Because it focuses on passive enumeration, it is useful during the early stages of an authorized security assessment.

Modern applications often use separate subdomains for customer portals, authentication, APIs, development environments, documentation, and cloud-hosted services. Some of these assets may not appear on the main website. Identifying them helps security professionals build a more complete picture of the target’s external attack surface.

In this guide, you will learn how Subfinder works, how to install it, how to use its main options, how to process results, and how to incorporate it into a responsible bug bounty reconnaissance workflow.

What Is Subfinder?

Subfinder is a command-line tool designed for passive subdomain enumeration. It collects subdomain information from supported online sources and returns the results for further analysis.

For example, a company may use the following domain structure:

• www.example.com — public website
• api.example.com — API service
• support.example.com — customer support
• dev.example.com — development environment
• status.example.com — service status page

A tester who only visits the main website may never discover every one of these assets.

Subfinder automates part of that discovery process. Instead of manually searching multiple public sources, you can run one command and collect available subdomain information.

The official Subfinder GitHub repository describes it as a fast passive subdomain enumeration tool with support for multiple sources, filtering, and different output formats.

It is important to understand that Subfinder primarily gathers existing information from passive sources. It does not, by itself, prove that every discovered hostname resolves or hosts an accessible application.

Why Is Subfinder Important for Bug Bounty Hunting?

A bug bounty assessment is only as complete as the assets that are discovered and tested within scope.

Organizations may operate many internet-facing services across cloud platforms, content delivery networks, SaaS providers, and internal development teams. As applications evolve, older hostnames can remain in public records even after the original service has changed.

Subdomain enumeration helps security researchers identify these assets before moving on to more detailed testing.

Discovering Additional Attack Surfaces

A domain may contain an API, an administrative portal, a staging website, or a legacy application. Each may have different authentication controls and security configurations.

For example, discovering api.example.com could lead a tester to investigate API authentication and authorization. Finding dev.example.com might reveal a separate application that needs to be checked against the program’s scope.

These are potential investigation paths, not proof of vulnerabilities.

Supporting Passive Reconnaissance

Subfinder can collect publicly available information without directly probing every discovered host. This makes it useful when you want to map a target before conducting active tests.

However, passive enumeration is not completely interaction-free: Subfinder may send requests to third-party data providers. It is also not a guarantee of anonymity or complete coverage.

Identifying Forgotten Assets

Old subdomains sometimes remain in DNS records or public datasets after a service has been retired.

A dangling DNS record that points to an unclaimed third-party resource can indicate a possible subdomain takeover risk. The condition requires careful validation; an unusual DNS response alone is not sufficient to confirm a vulnerability.

OWASP covers subdomain takeover testing and recommends a workflow that includes subdomain enumeration, fingerprinting, and manual validation.

Reference: OWASP — Testing for Subdomain Takeover.

How Does Subfinder Work?

Subfinder gathers hostname information from configured passive sources. Depending on the source and available credentials, the tool may retrieve data from certificate transparency services, passive DNS datasets, search engines, and other public information providers.

A typical workflow looks like this:

1. Provide a domain that you are authorized to assess.
2. Select the passive sources to query, or use the default source configuration.
3. Collect the returned subdomains.
4. Remove duplicate entries.
5. Save the results for analysis.
6. Validate relevant assets using approved follow-up tools.

For example, a certificate transparency record may show that a certificate was issued for portal.example.com. Subfinder may discover that hostname through a supported source, even if the hostname is not linked from the main website.

The result does not establish that the host is currently online. DNS resolution and HTTP checks are separate stages.

Installing Subfinder on Kali Linux

Subfinder is available through ProjectDiscovery’s official distribution methods. The installation process depends on your operating system and the version of Go required by the current release.

Install Using Go

If Go is installed and meets the version requirements for the current Subfinder release, run:

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Check the official installation documentation if you encounter a Go version or build error:

Subfinder Installation Guide.

Verify the Installation

After installation, check whether the command is available:

subfinder -h

To display the installed version, use:

subfinder -version

If your terminal reports that the command cannot be found, check whether Go’s binary directory is included in your PATH.

For many Go installations, the binary directory is:

$HOME/go/bin

You may need to add that directory to your shell configuration before running Subfinder from any location.

Basic Subfinder Command

The simplest way to enumerate subdomains for a single authorized domain is:

subfinder -d example.com

Replace example.com with a domain covered by your authorization or bug bounty scope.

The -d option specifies the domain to enumerate.

Subfinder then queries the configured passive sources and prints the subdomains it discovers.

Illustrative output might look like this:

api.example.com
cdn.example.com
docs.example.com
login.example.com
status.example.com

These hostnames are examples only, not actual scan results.

The number of results depends on the target, configured sources, API credentials, source availability, and other factors.

Display Only Subdomains

For cleaner output, use the -silent option:

subfinder -d example.com -silent

This is useful when you want to pass the results into another command or save a straightforward list for later processing.

Save Results to a File

You can store the discovered subdomains with the -o option:

subfinder -d example.com -o subdomains.txt

Saving results makes it easier to review the discovery process, compare scans, and document your assessment.

Enumerating Multiple Domains

Bug bounty programs sometimes include several in-scope domains. Subfinder supports reading a list of domains from a file.

Create a file named domains.txt:

example.com
example.org
example.net

Run:

subfinder -dL domains.txt -o subdomains.txt

The -dL option tells Subfinder to read domains from the specified list.

Before using a domain list, check every entry against the program’s current scope. A company name or shared brand does not automatically mean every related domain is authorized for testing.

Organizing Results by Domain

For multi-domain assessments, Subfinder also supports output directories:

subfinder -dL domains.txt -oD results/

This helps organize enumeration results by input domain, depending on the tool’s output behavior and version.

Check subfinder -h for the exact options supported by your installed release.

Using Different Passive Sources

Subfinder supports multiple data providers. Some sources work without credentials, while others require API keys or specific account access.

List Available Sources

Use:

subfinder -ls

This displays the sources supported by your installed version.

Specify Particular Sources

If you want to use specific supported sources, the -s option can help:

subfinder -d example.com -s crtsh

Source names and availability can change between versions. Confirm the valid names with subfinder -ls before using them.

Use All Supported Sources

Subfinder provides an -all option:

subfinder -d example.com -all

This requests enumeration using all supported sources available to the tool’s configuration. It may take longer than using a smaller selection of sources.

More sources do not guarantee a complete result. Some providers have limited coverage, API quotas, or temporary availability issues.

Configuring API Keys

Certain passive sources require API credentials. Configuring these providers can improve the information available to Subfinder.

The tool uses a provider configuration file, commonly located at:

~/.config/subfinder/provider-config.yaml

The precise location can vary depending on the operating system and configuration settings.

Follow the official Subfinder configuration instructions for supported providers and the correct configuration format.

Why API Keys Matter

Authenticated access may allow Subfinder to query additional datasets or use higher service quotas.

However, you should not assume that every provider requires a key or that every key unlocks the same coverage.

Keep API keys private, avoid committing them to public repositories, and use the provider’s recommended security practices.

Recursive Subdomain Enumeration

Some subdomains have additional subdomains of their own. For example:

example.com
api.example.com
v2.api.example.com

Subfinder supports the -recursive option for sources that can discover subdomains beneath other subdomains.

Example:

subfinder -d example.com -recursive

Recursive enumeration depends on the capabilities of the selected sources. It does not guarantee that every level of the domain hierarchy will be discovered.

For large organizations, recursive results can help identify additional hostnames that deserve review.

Filtering and Matching Results

Subfinder offers options for narrowing results.

Match Specific Subdomains

The -m option can match results against specified values or a list:

subfinder -d example.com -m api.example.com

Filter Known Results

The -f option can exclude specified subdomains or a supplied list from the results:

subfinder -d example.com -f old.example.com

Use these options when you need to focus on a subset of the discovery results. Consult subfinder -h for the exact accepted syntax in your installed version.

Filtering should not replace scope verification. Removing a hostname from output does not make it out of scope, and discovering a hostname does not make it in scope.

Working With JSON Output

Text output is convenient for manual review, but structured output is often more useful for automation and reporting.

Subfinder supports JSON Lines output through the -oJ option:

subfinder -d example.com -oJ -o subdomains.jsonl

JSON Lines stores separate JSON objects on individual lines. Depending on the selected options, records may include information about the hostname and its sources.

You can use this format when building a reconnaissance pipeline, tracking which sources returned a hostname, or processing results with a script.

For exact field names and output details, consult the documentation for the version you are using.

A Practical Subfinder Reconnaissance Workflow

Consider an authorized assessment of example.com.

The goal is to identify publicly discoverable subdomains and prepare a clean list for follow-up testing.

Step 1: Enumerate Subdomains

subfinder -d example.com -silent -o subdomains.txt

This creates a list of discovered hostnames.

Step 2: Review the Results

Inspect the output:

cat subdomains.txt

Look for hostnames that suggest different application functions, such as:

api.example.com
portal.example.com
docs.example.com
staging.example.com

These names provide useful context, but they do not prove that the hosts are accessible or vulnerable.

Step 3: Check DNS Resolution

A discovered hostname may no longer resolve. You can use a DNS utility to inspect an individual record:

dig api.example.com

For larger authorized lists, a DNS resolution tool can help separate resolving hostnames from those that currently have no usable DNS response.

Remember that a hostname resolving successfully does not prove that a web service is running.

Step 4: Identify Live Web Services

After checking scope and DNS resolution, an approved HTTP probing tool can help determine which hosts respond over HTTP or HTTPS.

This is an active follow-up stage, unlike Subfinder’s passive enumeration. Apply the program’s rate limits and restrictions before running it.

Step 5: Prioritize Manual Review

Review the discovered assets and decide which ones merit further investigation.

For example, an in-scope API may warrant authorization testing, while a staging application may warrant checks for exposed test functionality. Any security issue must be validated before reporting.

OWASP’s Attack Surface Identification guidance explains why identifying domains, virtual hosts, exposed services, and application entry points is an important foundation for security testing.

Subfinder and Subdomain Takeover Risks

One reason bug hunters enumerate subdomains is to identify possible configuration problems involving external hosting services.

A subdomain takeover can occur when a DNS record points to a resource that has been removed or deprovisioned, and the associated service permits an unauthorized party to claim that resource.

For example, an organization might retain a CNAME record pointing to a retired third-party hosting project.

Subfinder can help identify the hostname, but it does not establish that a takeover is possible.

A responsible investigation involves:

1. Confirming the hostname is in scope.
2. Inspecting the relevant DNS records.
3. Identifying the destination service.
4. Checking for reliable evidence of a dangling resource.
5. Following the program’s rules for validation.
6. Documenting the evidence without claiming control over a resource or making unauthorized changes.

Read the OWASP subdomain takeover testing guide for further context.

Subfinder vs Active Enumeration Tools

Subfinder and active discovery tools have different roles.

Tool type	Primary purpose
Subfinder	Passive subdomain discovery
DNS resolution tools	Check DNS records and resolution
HTTP probing tools	Identify responding web services
FFUF	Discover paths and fuzz web inputs
Nmap	Scan ports and identify network services, when authorized

These tools can complement one another, but they are not interchangeable.

A useful sequence is to begin with passive discovery, validate the relevant hostnames, and then conduct carefully scoped active testing.

For more details, see the official ProjectDiscovery tools.

Common Subfinder Mistakes

Assuming Every Result Is Live

Subfinder may return hostnames that no longer resolve. Verify DNS and service availability separately.

Assuming No Results Means No Subdomains

Passive data sources have incomplete coverage. Missing API keys, unavailable providers, and limited historical data can affect results.

Ignoring the Scope

Only test assets explicitly covered by your authorization. Third-party services and related domains may have separate ownership and rules.

Skipping Result Validation

A discovered hostname is an investigation lead, not a confirmed security finding.

Exposing API Credentials

Keep provider credentials out of screenshots, public repositories, and reports that do not need them.

Using Outdated Tool Versions

Check the official repository and documentation for installation requirements, available options, and updates.

Best Practices for Bug Hunters

For a reliable reconnaissance workflow:

• Start with passive enumeration before active testing.
• Verify every target against the authorized scope.
• Save raw results and document the tool version.
• Configure supported sources where appropriate.
• Check DNS resolution before assuming a service is available.
• Deduplicate and organize results for analysis.
• Apply rate limits to active follow-up tools.
• Validate potential vulnerabilities manually.
• Report evidence clearly and avoid overstating impact.

If you are building your practical skills, explore “https://academy.pentesthint.com/” cyber security training and practice in authorized “https://vuln.pentesthint.com/” vulnerability labs.

Building a Career in Reconnaissance and Penetration Testing

Subdomain enumeration is one skill within a broader penetration-testing workflow. Professionals also need a solid understanding of DNS, HTTP, TLS certificates, Linux, web application architecture, cloud infrastructure, and common security weaknesses.

A useful learning path includes:

1. Learn DNS records and domain resolution.
2. Understand passive and active reconnaissance.
3. Practice Subfinder on authorized lab targets.
4. Learn to validate hostnames and HTTP services.
5. Study web application vulnerabilities and access controls.
6. Practice documenting findings with clear evidence.
7. Learn how to follow rules of engagement and bug bounty policies.

Subfinder becomes much more useful when you understand the data it collects and the limitations of each discovery method.

FAQs

What is Subfinder used for?

Subfinder is used for passive subdomain enumeration. It gathers publicly available hostname information from supported sources to help security researchers map an organization’s external attack surface.

Is Subfinder free to use?

Subfinder is an open-source tool. Some of its supported data providers may require separate API keys, accounts, or paid subscriptions.

Is Subfinder a passive or active tool?

Subfinder is primarily designed for passive subdomain enumeration. It queries supported information sources rather than performing comprehensive direct scans of every discovered host.

How do I install Subfinder on Kali Linux?

You can install it using Go when your environment meets the current release’s requirements:

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Refer to the official ProjectDiscovery installation guide for other methods and configuration details.

Does Subfinder find all subdomains?

No. Results depend on source coverage, configuration, API access, and the information available to each provider. No single passive discovery tool can guarantee a complete inventory.

Can Subfinder detect subdomain takeover vulnerabilities?

No. Subfinder can discover hostnames that may be worth investigating, but takeover testing requires additional DNS analysis, service fingerprinting, and manual validation.

What is the difference between Subfinder and DNS brute forcing?

Subfinder primarily gathers existing hostname information from passive sources. DNS brute forcing actively tests candidate names against DNS infrastructure using a wordlist. The methods have different traffic patterns, coverage, and operational considerations.

Can I use Subfinder for bug bounty programs?

Yes, when the relevant domain is explicitly in scope and the program permits the activity. Review the program’s policy before performing active follow-up testing.

Conclusion

Subfinder is a useful tool for discovering subdomains during the reconnaissance phase of penetration testing and bug bounty hunting. It simplifies the collection of publicly available hostname information and supports workflows that include source selection, filtering, recursive discovery, and structured output.

The most important lesson is to treat enumeration as the beginning of the assessment. Validate DNS records, determine which services are accessible, review the authorized scope, and investigate promising assets carefully. A long list of subdomains is not valuable on its own; the goal is to understand the attack surface and identify genuine security risks.

For more cybersecurity tutorials and practical learning resources, visit “https://pentesthint.com/” PentestHint and continue building your reconnaissance skills in authorized environments.