id       = "subfinder"
name     = "Subfinder"
homepage = "https://docs.projectdiscovery.io/opensource/subfinder/"
description = "A passive subdomain discovery tool that discovers valid subdomains for websites."
executables   = ["subfinder"]

[dotfiles]

# ProjectDiscovery's official install page
# (https://docs.projectdiscovery.io/opensource/subfinder/install) says API keys
# are stored in $HOME/.config/subfinder/provider-config.yaml. Its documented
# Windows spelling is %USERPROFILE%/.config/subfinder/provider-config.yaml;
# this file contains provider API keys, so it is a whole-file secret.
paths = []
secret = [
  "~/.config/subfinder/provider-config.yaml",
  "%USERPROFILE%/.config/subfinder/provider-config.yaml",
]

[commands]
format = 1
label = "Enumerate subdomains"
description = "Passive subdomain discovery for one or more domains. Provider config, filters, resolvers and update flags are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.source]]
id = "s"
kind = "help"
url = "https://github.com/projectdiscovery/subfinder"
revision = "2026-10-27"
evidence = """
-d, -domain string[]  domains to find subdomains for
-dL, -list string     file containing list of domains for subdomain discovery
-s, -sources string[]           specific sources to use for discovery (-s crtsh,github). Use -ls to display all available sources.
-recursive                      use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)
-all                            use all sources for enumeration (slow)
-es, -exclude-sources string[]  sources to exclude from enumeration (-es alienvault,zoomeyeapi)
-m, -match string[]     subdomain or list of subdomain to match (file or comma separated)
-rl, -rate-limit int  maximum number of http requests to send per second
-t int                number of concurrent goroutines for resolving (-active only) (default 10)
-o, -output string       file to write output to
-oJ, -json               write output in JSONL format
-r string[]                   comma separated list of resolvers to use
-nW, -active                  display active subdomains only
-proxy string                 http proxy to use with subfinder
-silent             show only subdomains in output
-timeout int                  seconds to wait before timing out (default 30)
-max-time int                 minutes to wait for enumeration results (default 10)
"""

[[commands.field]]
id = "domain"
label = "Domain"
description = "Domain to find subdomains for (comma-separated for several)."
type = "string"
option = ["-d", "-domain"]
sources = ["s"]

[[commands.field]]
id = "list"
label = "Domain list file"
type = "path"
option = ["-dL", "-list"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["s"]

[[commands.field]]
id = "sources"
label = "Sources"
description = "Comma-separated sources, e.g. crtsh,github."
type = "string"
option = ["-s", "-sources"]
sources = ["s"]

[[commands.field]]
id = "all"
label = "Use all sources (slow)"
type = "boolean"
option = ["-all"]
sources = ["s"]

[[commands.field]]
id = "recursive"
label = "Recursive-capable sources only"
type = "boolean"
option = ["-recursive"]
sources = ["s"]

[[commands.field]]
id = "active"
label = "Active subdomains only"
type = "boolean"
option = ["-nW", "-active"]
sources = ["s"]

[[commands.field]]
id = "silent"
label = "Only print subdomains"
type = "boolean"
option = ["-silent"]
sources = ["s"]

[[commands.field]]
id = "json"
label = "JSON lines output"
type = "boolean"
option = ["-oJ", "-json"]
sources = ["s"]

[[commands.field]]
id = "output"
label = "Output file"
type = "path"
option = ["-o", "-output"]
path = { kind = "file", role = "output", must_exist = false }
effect = "overwrite"
sources = ["s"]

[[commands.field]]
id = "rate_limit"
label = "Max requests per second"
type = "integer"
option = ["-rl", "-rate-limit"]
sources = ["s"]

[[commands.field]]
id = "timeout"
label = "Timeout (seconds)"
type = "integer"
option = ["-timeout"]
sources = ["s"]

[[commands.task]]
id = "domain"
label = "Find subdomains of a domain"
fields = ["domain", "silent", "output"]
required = ["domain"]

[[commands.task]]
id = "list"
label = "Find subdomains for a list"
fields = ["list", "silent", "output"]
required = ["list"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["domain", "list", "silent", "output"]

[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["sources", "all", "recursive", "active", "json", "rate_limit", "timeout"]