id = "subfinder"
name = "Subfinder"
homepage = "https://docs.projectdiscovery.io/opensource/subfinder/"
description = "A passive subdomain discovery tool that discovers valid subdomains for websites."
executables = ["subfinder"]
[dotfiles]
paths = []
secret = [
"~/.config/subfinder/provider-config.yaml",
"%USERPROFILE%/.config/subfinder/provider-config.yaml",
]
[commands]
format = 1
label = "Enumerate subdomains"
description = "Passive subdomain discovery for one or more domains. Provider config, filters, resolvers and update flags are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }
[[commands.source]]
id = "s"
kind = "help"
url = "https://github.com/projectdiscovery/subfinder"
revision = "2026-10-27"
evidence = """
-d, -domain string[] domains to find subdomains for
-dL, -list string file containing list of domains for subdomain discovery
-s, -sources string[] specific sources to use for discovery (-s crtsh,github). Use -ls to display all available sources.
-recursive use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)
-all use all sources for enumeration (slow)
-es, -exclude-sources string[] sources to exclude from enumeration (-es alienvault,zoomeyeapi)
-m, -match string[] subdomain or list of subdomain to match (file or comma separated)
-rl, -rate-limit int maximum number of http requests to send per second
-t int number of concurrent goroutines for resolving (-active only) (default 10)
-o, -output string file to write output to
-oJ, -json write output in JSONL format
-r string[] comma separated list of resolvers to use
-nW, -active display active subdomains only
-proxy string http proxy to use with subfinder
-silent show only subdomains in output
-timeout int seconds to wait before timing out (default 30)
-max-time int minutes to wait for enumeration results (default 10)
"""
[[commands.field]]
id = "domain"
label = "Domain"
description = "Domain to find subdomains for (comma-separated for several)."
type = "string"
option = ["-d", "-domain"]
sources = ["s"]
[[commands.field]]
id = "list"
label = "Domain list file"
type = "path"
option = ["-dL", "-list"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["s"]
[[commands.field]]
id = "sources"
label = "Sources"
description = "Comma-separated sources, e.g. crtsh,github."
type = "string"
option = ["-s", "-sources"]
sources = ["s"]
[[commands.field]]
id = "all"
label = "Use all sources (slow)"
type = "boolean"
option = ["-all"]
sources = ["s"]
[[commands.field]]
id = "recursive"
label = "Recursive-capable sources only"
type = "boolean"
option = ["-recursive"]
sources = ["s"]
[[commands.field]]
id = "active"
label = "Active subdomains only"
type = "boolean"
option = ["-nW", "-active"]
sources = ["s"]
[[commands.field]]
id = "silent"
label = "Only print subdomains"
type = "boolean"
option = ["-silent"]
sources = ["s"]
[[commands.field]]
id = "json"
label = "JSON lines output"
type = "boolean"
option = ["-oJ", "-json"]
sources = ["s"]
[[commands.field]]
id = "output"
label = "Output file"
type = "path"
option = ["-o", "-output"]
path = { kind = "file", role = "output", must_exist = false }
effect = "overwrite"
sources = ["s"]
[[commands.field]]
id = "rate_limit"
label = "Max requests per second"
type = "integer"
option = ["-rl", "-rate-limit"]
sources = ["s"]
[[commands.field]]
id = "timeout"
label = "Timeout (seconds)"
type = "integer"
option = ["-timeout"]
sources = ["s"]
[[commands.task]]
id = "domain"
label = "Find subdomains of a domain"
fields = ["domain", "silent", "output"]
required = ["domain"]
[[commands.task]]
id = "list"
label = "Find subdomains for a list"
fields = ["list", "silent", "output"]
required = ["list"]
[[commands.group]]
id = "basic"
label = "Basic"
fields = ["domain", "list", "silent", "output"]
[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["sources", "all", "recursive", "active", "json", "rate_limit", "timeout"]
