How to Use the Command 'subfinder' (with Examples)

Subfinder is a powerful tool designed to discover valid subdomains for websites. It plays a crucial role in the fields of cybersecurity, bug hunting, and penetration testing. By employing a passive framework, Subfinder is particularly safe and efficient for identifying subdomain-related vulnerabilities without actively interacting with the targeted systems. It gathers data using inputs from a wide array of sources, and presents it in a comprehensible manner, making it highly valuable for security researchers and enthusiasts.

Use Case 1: Find Subdomains for a Specific Domain

Code:

subfinder -d example.com

Motivation:

Identifying subdomains is a fundamental step in security assessments like penetration testing and bug bounty hunting. Each subdomain may represent a different component or service, and could potentially have security vulnerabilities that need to be addressed. Running this command against a domain like “example.com” can effectively uncover these digital assets that are often overlooked, thus enhancing the overall security posture.

Explanation:

• subfinder: The core command used to invoke the tool.
• -d example.com: Specifies the domain “example.com” for which subdomains need to be discovered. The -d flag stands for “domain.”

Example Output:

blog.example.com
shop.example.com
dev.example.com
api.example.com

Use Case 2: Show Only the Subdomains Found

Code:

subfinder -silent -d example.com

Motivation:

When conducting subdomain enumeration, it may be necessary to focus solely on the results without additional logging or status messages. This is particularly useful when the results are to be parsed by another tool or integrated into a larger data processing pipeline. By running Subfinder in silent mode, users receive a cleaner and more streamlined output comprising only the discovered subdomains.

Explanation:

• -silent: This argument suppresses all non-essential output, ensuring that only the results (subdomains) are displayed.
• -d example.com: Target domain for which subdomains are searched.

Example Output:

mail.example.com
ftp.example.com
crm.example.com

Use Case 3: Show Only Active Subdomains

Code:

subfinder -nW -d example.com

Motivation:

In the context of security assessments, knowing which subdomains are currently active (responding to network probes) is of high importance. Active subdomains indicate accessible services which might be vulnerable at present. This can significantly reduce the number of subdomains requiring further investigation, optimizing both time and resources during an assessment.

Explanation:

• -nW: Consists of two flags, -n which resolves the IP address of subdomains, and -W which filters out inactive subdomains by checking for HTTP/HTTPS response.
• -d example.com: Refers to the target domain for which active subdomains are sought.

Example Output:

app.example.com
portal.example.com

Use Case 4: Use All Sources for Enumeration

Code:

subfinder -all -d example.com

Motivation:

Some subdomains might be listed in certain databases, but not in others. By using all available sources, you maximally broaden the net, ensuring the capture of the most exhaustive list of subdomains possible. This comprehensive approach is often necessary when dealing with large or well-obfuscated domain structures where data might be fragmented across different repositories.

Explanation:

• -all: Employs all potential data sources available to Subfinder, ensuring the widest search for subdomains.
• -d example.com: The example target domain to be scanned for subdomains.

Example Output:

assets.example.com
internal.example.com
qa.example.com
support.example.com

Use Case 5: Use a Given Comma-Separated List of Resolvers

Code:

subfinder -r 8.8.8.8,1.1.1.1 -d example.com

Motivation:

The resolver specified influences the DNS resolution process. Customizing resolvers could help in bypassing DNS-level filtering imposed by certain networks or obtaining faster resolution times. By explicitly choosing resolvers, users can achieve greater control over and reliability in the enumeration process.

Explanation:

• -r 8.8.8.8,1.1.1.1: This argument sets the DNS servers (resolvers) used for querying subdomains. The given IPs illustrate Google’s public DNS (8.8.8.8) and Cloudflare DNS (1.1.1.1).
• -d example.com: Indicates the domain to analyze.

Example Output:

proxy.example.com
staging.example.com
cdn.example.com

Conclusion

Subfinder is an essential tool in the arsenal of any cybersecurity professional or enthusiast keen on identifying subdomain-level entry points. The provided examples highlight its versatility in different scenarios—from basic enumeration to customized resolver handling—all contributing to the discovery and securing of digital assets.