Recon
subfinder
Passive subdomain discovery from OSINT sources for in-scope apex domains.
What it is
subfinder queries aggregators and certificate sources to list subdomains without touching the client's name servers. It is the quiet first pass on web and external jobs. Feed output to httpx before any crawling or scanning.
Reach for it when
Early recon on a named apex when you want inventory without generating DNS traffic on production resolvers.
Watch-outs
API keys for third-party sources are yours — do not upload client domain lists to personal accounts that retain data. Filter out out-of-scope acquisitions and SaaS tenants the client does not own.
Typical invocation
subfinder -d lumenfreight.example -silent -o recon/subs.txt
Authorized assessments only. Stay inside the rules of engagement.
Pin to a kit
Open an engagement first.
Related
- OWASP Amass
Attack-surface mapper for subdomain enumeration, ASN mapping, and OSINT on in-scope domains.
- httpx
HTTP probe to confirm live web services, titles, status codes, and tech from a host list.
- nuclei
Template-based vulnerability scanner for known issues on in-scope web, API, and network services.
- katana
Crawler for JavaScript-heavy web apps and APIs to build an authorized URL inventory.