By Jackson Godwin. Cybersecurity Analyst & Penetration Tester.
Disclaimer This content is provided for educational and research purposes only. Subfinder is an open-source passive subdomain enumeration tool designed for legitimate bug bounty hunting, authorized security assessments, and defensive reconnaissance.
This tutorial is intended for use on authorized targets, lab environments, or domains where explicit written permission has been obtained. Users are solely responsible for ensuring compliance with all relevant laws, regulations, and bug bounty program policies. The author disclaims any liability for misuse, damage, or legal consequences arising from the use of this tool
Hey everyone! Hope you’re all doing great and leveling up your cybersecurity skills. Today, we’ve got another cool tool to add to your bug hunting arsenal – Subfinder! This tool is all about discovering subdomains using passive online sources. It’s fast, modular, and does one thing really, really well – passive subdomain enumeration. Let’s dive in!
Let’s take a look 😛 !!
Installation
sudo apt install golang-go -y go version echo ‘export PATH=$PATH:$(go env GOPATH)/bin’ >> ~/.bashrc go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
After installing we need to check the version of the tool.
subfinder -version
Now it’s time to check whether it is working perfectly or not. All you have to do is given the name of the domain you want to hunt and that’s it. After executing the command, all the results will be visible on the terminal.
Sometimes we need to check about the tool, and how it is attacking, then we can use verbose mode to get deeper details about the target.
If you want to hunt two or more domains simultaneously, then you can create a list and specify that list in the command.
Security Recommendations
Regularly monitor your organization’s public-facing subdomains.
Remove unused or abandoned subdomains to reduce the attack surface.
Secure development and staging subdomains with proper authentication.
Enable HTTPS and valid TLS certificates on public subdomains.
Conduct periodic asset discovery to identify forgotten or misconfigured systems.
Continuously monitor for newly exposed subdomains.
Detection Tips
Monitor DNS changes for unauthorized subdomains.
Use asset inventory tools to track newly discovered subdomains.
Review DNS logs for suspicious enumeration activity.
Investigate unexpected public-facing services discovered during routine scans.
Ethical Use Notice
This article is intended for educational purposes and authorized security assessments only. Subfinder should be used only to discover publicly available subdomains belonging to systems you own or have explicit permission to assess. Unauthorized reconnaissance may violate organizational policies or applicable laws.
Conclusion
Subfinder is a valuable OSINT and asset discovery tool that helps security professionals identify public-facing subdomains. Regular subdomain enumeration enables organizations to maintain an accurate asset inventory, detect exposed services, and strengthen their overall security posture
About the Author
Jackson Godwin is a Cybersecurity Consultant specializing in Vulnerability Assessment and Penetration Testing (VAPT), Governance, Risk and Compliance (GRC), Information Security, and Enterprise Security Assessments. He has experience assessing web applications, banking systems, and enterprise environments to identify security vulnerabilities and improve organizational resilience.
Through JacksonTechnology.com.ng, Jackson shares practical cybersecurity tutorials, penetration testing guides, compliance resources, and career advice to help professionals and businesses strengthen their cybersecurity posture.
