Ultimate Subfinder Cheat Sheet

Samir KC
March 16, 2026


Ultimate Subfinder Cheat Sheet

A fast, passive subdomain discovery tool that scours the internet.

1. Basic Usage

The core command to find subdomains passively.

Single Target

Find subdomains for one domain.

subfinder -d target.com

Multiple Targets

Use a list of domains from a file.

subfinder -dL domains.txt

Silent Mode (Pipeline Ready)

Only output the subdomains (no banners or logs). Perfect for piping into other tools.

subfinder -d target.com -silent

2. Configuration & API Keys

Subfinder works best when you provide API keys for services like Shodan, Censys, GitHub, etc.

Locate Config File

The config file is usually generated after the first run.

cat ~/.config/subfinder/provider-config.yaml

Listing Providers

See which sources are available and configured.

subfinder -ls
Note: You must manually edit the YAML file to add your API keys. E.g.,
shodan: [YOUR_KEY]

3. Piping & Chaining

Subfinder is designed to work with other ProjectDiscovery tools.

Subfinder -> HTTPX

Find subdomains, then check which ones have live web servers.

subfinder -d target.com -silent | httpx -title -tech-detect -status-code

Subfinder -> Nuclei

Find subdomains, then scan them for vulnerabilities.

subfinder -d target.com -silent | nuclei -t cves/

Subfinder -> Naabu

Find subdomains, then port scan them.

subfinder -d target.com -silent | naabu -silent

4. Filtering Sources

Control where Subfinder gets its data from.

Use Specific Sources

Only use specific providers (e.g., only Archive.org and Crt.sh).

subfinder -d target.com -s archiveorg,crtsh

Exclude Sources

Exclude slow or noisy providers.

subfinder -d target.com -es alienvault

All Sources (Active)

Use every available source (might be slower).

subfinder -d target.com -all

5. Output Formats

Save to File

subfinder -d target.com -o results.txt

JSON Output

Useful for parsing with jq or other scripts. Contains source info.

subfinder -d target.com -oJ -o results.json

Verbose Mode

See exactly which source found which subdomain.

subfinder -d target.com -v
⇧