{
  "id": "subfinder",
  "name": "Subfinder",
  "homepage": "https://docs.projectdiscovery.io/opensource/subfinder/",
  "description": "A passive subdomain discovery tool that discovers valid subdomains for websites.",
  "executables": [
    "subfinder"
  ],
  "dotfiles": {
    "paths": [],
    "secret": [
      "~/.config/subfinder/provider-config.yaml",
      "%USERPROFILE%/.config/subfinder/provider-config.yaml"
    ]
  },
  "commands": {
    "format": 1,
    "label": "Enumerate subdomains",
    "description": "Passive subdomain discovery for one or more domains. Provider config, filters, resolvers and update flags are left out.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": false,
      "short_bundles": false
    },
    "source": [
      {
        "id": "s",
        "kind": "help",
        "url": "https://github.com/projectdiscovery/subfinder",
        "revision": "2026-10-27",
        "evidence": "-d, -domain string[]  domains to find subdomains for\n-dL, -list string     file containing list of domains for subdomain discovery\n-s, -sources string[]           specific sources to use for discovery (-s crtsh,github). Use -ls to display all available sources.\n-recursive                      use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)\n-all                            use all sources for enumeration (slow)\n-es, -exclude-sources string[]  sources to exclude from enumeration (-es alienvault,zoomeyeapi)\n-m, -match string[]     subdomain or list of subdomain to match (file or comma separated)\n-rl, -rate-limit int  maximum number of http requests to send per second\n-t int                number of concurrent goroutines for resolving (-active only) (default 10)\n-o, -output string       file to write output to\n-oJ, -json               write output in JSONL format\n-r string[]                   comma separated list of resolvers to use\n-nW, -active                  display active subdomains only\n-proxy string                 http proxy to use with subfinder\n-silent             show only subdomains in output\n-timeout int                  seconds to wait before timing out (default 30)\n-max-time int                 minutes to wait for enumeration results (default 10)\n"
      }
    ],
    "field": [
      {
        "id": "domain",
        "label": "Domain",
        "description": "Domain to find subdomains for (comma-separated for several).",
        "type": "string",
        "option": [
          "-d",
          "-domain"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "list",
        "label": "Domain list file",
        "type": "path",
        "option": [
          "-dL",
          "-list"
        ],
        "path": {
          "kind": "file",
          "role": "input",
          "must_exist": true
        },
        "sources": [
          "s"
        ]
      },
      {
        "id": "sources",
        "label": "Sources",
        "description": "Comma-separated sources, e.g. crtsh,github.",
        "type": "string",
        "option": [
          "-s",
          "-sources"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "all",
        "label": "Use all sources (slow)",
        "type": "boolean",
        "option": [
          "-all"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "recursive",
        "label": "Recursive-capable sources only",
        "type": "boolean",
        "option": [
          "-recursive"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "active",
        "label": "Active subdomains only",
        "type": "boolean",
        "option": [
          "-nW",
          "-active"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "silent",
        "label": "Only print subdomains",
        "type": "boolean",
        "option": [
          "-silent"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "json",
        "label": "JSON lines output",
        "type": "boolean",
        "option": [
          "-oJ",
          "-json"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "output",
        "label": "Output file",
        "type": "path",
        "option": [
          "-o",
          "-output"
        ],
        "path": {
          "kind": "file",
          "role": "output",
          "must_exist": false
        },
        "effect": "overwrite",
        "sources": [
          "s"
        ]
      },
      {
        "id": "rate_limit",
        "label": "Max requests per second",
        "type": "integer",
        "option": [
          "-rl",
          "-rate-limit"
        ],
        "sources": [
          "s"
        ]
      },
      {
        "id": "timeout",
        "label": "Timeout (seconds)",
        "type": "integer",
        "option": [
          "-timeout"
        ],
        "sources": [
          "s"
        ]
      }
    ],
    "task": [
      {
        "id": "domain",
        "label": "Find subdomains of a domain",
        "fields": [
          "domain",
          "silent",
          "output"
        ],
        "required": [
          "domain"
        ]
      },
      {
        "id": "list",
        "label": "Find subdomains for a list",
        "fields": [
          "list",
          "silent",
          "output"
        ],
        "required": [
          "list"
        ]
      }
    ],
    "group": [
      {
        "id": "basic",
        "label": "Basic",
        "fields": [
          "domain",
          "list",
          "silent",
          "output"
        ]
      },
      {
        "id": "advanced",
        "label": "Advanced",
        "fields": [
          "sources",
          "all",
          "recursive",
          "active",
          "json",
          "rate_limit",
          "timeout"
        ]
      }
    ]
  }
}