subfinder
all
Discover valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.
More info →Options (2)
-dbooleanFind subdomains for a specific domain
Example:
subfinder {{[-d|-domain]}} {{example.com}}Show only active subdomains
Example:
subfinder {{[-nW|-active]}} {{[-d|-domain]}} {{example.com}}Examples (5)
Find subdomains for a specific domain
subfinder [-d|-domain] example.comShow only the subdomains found
subfinder -silent [-d|-domain] example.comShow only active subdomains
subfinder [-nW|-active] [-d|-domain] example.comUse all sources for enumeration
subfinder -all [-d|-domain] example.comUse a given comma-separated list of [r]esolvers
subfinder -r 8.8.8.8,1.1.1.1,... [-d|-domain] example.commade by @shridhargupta | data from tldr-pages