Recon & OSINT

Subfinder

Passive subdomain discovery at scale.

osintdnsrecon

subfinder — terminal

$ subfinder -d example.com -silent

What it does

Subfinder enumerates subdomains using passive online sources, returning results fast without sending traffic to the target. A staple first step in external reconnaissance.

Source

https://github.com/projectdiscovery/subfinder ↗

More Recon & OSINT tools

AmassIn-depth DNS enumeration and attack-surface mapping.dnsxFast, multi-purpose DNS toolkit for resolution and probing.theHarvesterEmail, subdomain, and host OSINT gathering.MetagoofilMetadata extraction from public documents.

Need hosted scanning instead of local tooling?

Run a scan in the browser →