For all of the flags and options available for Subfinder be sure to check out the Usage page. On this page we’ll share examples running Subfinder with specific flags and goals and the output you can expect from each. If you have questions, reach out to us through Help.

Basic Usage

To run Subfinder on a specific target use the -d flag to specify the domain.

subfinder -d

               __    _____           __         
   _______  __/ /_  / __(_)___  ____/ /__  _____
  / ___/ / / / __ \/ /_/ / __ \/ __  / _ \/ ___/
 (__  ) /_/ / /_/ / __/ / / / / /_/ /  __/ /    
/____/\__,_/_.___/_/ /_/_/ /_/\__,_/\___/_/ v2.4.9

Use with caution. You are responsible for your actions
Developers assume no liability and are not responsible for any misuse or damage.
By using subfinder, you also agree to the terms of the APIs used.

[INF] Enumerating subdomains for

[INF] Found 18 subdomains for in 3 seconds 672 milliseconds

Pipe Results to Other Tools

The subdomains discovered can be piped to other tools. For example, you can pipe the discovered subdomains to httpx which will then find running HTTP servers on the host.

echo | subfinder -silent | httpx -silent

Subfinder and Docker

Pull the latest tagged subfinder Docker image using:

docker pull projectdiscovery/subfinder:latest

Run subfinder using the Docker image:

docker run projectdiscovery/subfinder:latest -d

Run subfinder using the Docker image with a local config file:

docker run -v $CONFIG/subfinder:/root/.config/subfinder -t projectdiscovery/subfinder -d

Subfinder Go library

subfinder can also be used as library and a minimal examples of using subfinder SDK is available in the example library.