subfinder ¶

subfinder (11.0k ⭐) is a tool that may be used to passively find subdomains. It's written in Go.

$ sudo apt install -y subfinder
$ subfinder -d example.com

A few of the free APIs used by subfinder:

• https://api.hackertarget.com/hostsearch/?q={domain}
• https://crt.sh/?q={domain}&output=json
• https://leakix.net/domain/{domain}
• https://api.subdomain.center/?domain={domain}
• https://certificatedetails.com/{domain}
• https://otx.alienvault.com/api/v1/indicators/domain/{domain}/passive_dns
• ... and a few others that are sometimes unreliable