← All Kali Commands
🔍 Reconnaissance Subfinder

Find subdomains passively

Subfinder command for find subdomains passively. Copy the command below and use it in your terminal.

subfinder — terminal
┌──(kali㉿kali)-[~]
└─$ subfinder -d target.com
Tool
Subfinder
Category
Reconnaissance
Purpose
Find subdomains passively

🛡️ Usage Tips

  • Always ensure you have proper authorization before using Subfinder against any target
  • Replace target with the actual IP address or hostname you are testing
  • Run this command from a Kali Linux terminal or any system with Subfinder installed
  • Combine with other Subfinder commands for more comprehensive results
  • Pipe output to a file with > output.txt for later analysis

🔗 More Subfinder Commands

subfinder -d target.com -o subs.txt
Save to file
subfinder -d target.com -all
Use all sources
subfinder -dL domains.txt
Multiple domains from file
subfinder -d target.com -silent
Clean output only
subfinder -d target.com -t 50
50 concurrent threads
subfinder -d target.com -nW
Remove wildcard subdomains
subfinder -d target.com -rL resolvers.txt
Custom resolvers
subfinder -d target.com -cs
Collect sources info
subfinder -d target.com -oJ
JSON output format
subfinder -d target.com -max-time 10
Max 10 minutes
subfinder -d target.com -recursive
Recursive enumeration
subfinder -d target.com -pc provider-config.yaml
Provider config

🔍 Other Reconnaissance Tools

Nmap Masscan RustScan Amass DNSrecon theHarvester
📚 Learn Kali Linux — Free Course