subfinder
Fast passive subdomain discovery.
KaliParrotpassive
pkg: subfinder
subfinder finds subdomains using only passive online sources, making it fast and stealthy for the discovery phase.
Syntax
subfinder -d {domain} [-silent]
Example
subfinder -silent -d example.com
Prints discovered subdomains, one per line, from passive sources only.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
subfinder
Usage examples
subfinder -silent -d target.tld
Quick passive subdomains.
subfinder -d target.tld -all -o subs.txt
Maximum coverage to a file.
Advantages
- Very fast and purely passive
- Clean, pipeable output
- Easy API-source configuration
Disadvantages
- Only as good as its sources
- No active validation (verify hosts are live)
- API keys improve coverage
Tags
#subdomains#passive
Official docs: subfinder ↗
Related commands
Frequently asked questions
What is subfinder used for?
subfinder finds subdomains using only passive online sources, making it fast and stealthy for the discovery phase.
What is an example subfinder command?
A common example is: subfinder -silent -d example.com — Prints discovered subdomains, one per line, from passive sources only.
Is subfinder part of Kali Linux?
Yes. subfinder ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install subfinder.
What category of security tool is subfinder?
subfinder is a Information Gathering tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.