subfinder
Passive subdomain enumeration from public sources.
Enumerates subdomains **passively**: it does not query the victim DNS, it aggregates what certificate transparency, search engines and passive DNS databases already publish. That makes it quiet and fast, and also incomplete by design: whatever never reached the Internet will not show up. The usual flow is passive first (subfinder) and brute force afterwards (gobuster/ffuf in vhost mode) over what is left.
Family Recon, DNS & OSINT
Flags -d -all -silent -o
Concepts Virtual Host Fuzzing, DNS zone transfer (AXFR)
Cheatsheet DNS · 53
Installation
# go install; o binario de releasesUseful commands
Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.