> ## Content Index
> Fetch the complete content index at: https://linuxhandbook.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Finding Subdomains with Subfinder in Linux
- URL: https://linuxhandbook.com/finding-subdomains-subfinder/
- Published: 2025-09-19T10:26:59.000Z
- Updated: 2025-09-19T10:26:59.000Z
- Description: Checking subdomains of a website provides new scopes for vulnerability assessment.
- Author: Hangga Aji Sayekti
- Tags: Pen Test, #docs-col

When you start exploring a target website, the first question to ask is simple: *what names exist out there?* 

Before you think about vulnerabilities or exploits, you would want a map of subdomains. That map can reveal forgotten login pages, staging servers, or even entire apps that weren’t meant to be public.

![](https://linuxhandbook.com/content/images/2025/09/target-website-for-expliotation-1.png)

My preferred tool for this first step is [**subfinder**](https://github.com/projectdiscovery/subfinder?ref=linuxhandbook.com). It’s simple, quiet, and quick. In this guide, we’ll walk through installing subfinder on Kali Linux, running the most useful commands, saving results, and experimenting with extra flags. 

**We’ll practice together on** [**vulnweb.com**](https://vulnweb.com/?ref=linuxhandbook.com)**, a safe site for learning.**

## What subfinder actually does

Subfinder is a passive subdomain discovery tool. Instead of hammering DNS servers or brute-forcing names, it asks public sources: certificate transparency logs, DNS databases, GitHub, and more. That’s why it’s fast and low-noise.

The catch: subfinder gives us *names only*. Some names may be stale and some may point to nothing. And that’s fine. At this stage, all we need is a clean list of possible subdomains. Later, we can resolve and probe them.

## Installing subfinder on Kali Linux

You have two easy choices:

**Install via apt (fastest):**

```bash
sudo apt update
sudo apt install subfinder

```

**Install the latest version via Go:**

```bash
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
echo 'export PATH=$PATH:$HOME/go/bin' >> ~/.bashrc && source ~/.bashrc

```

If youn are just starting out, the apt version is fine. If something feels buggy, you can switch to the Go install for the newest release.

## Understanding the basic flags

- `-d` chooses the domain
- `-silent` prints one subdomain per line, no banners
- `-o` saves to a text file
- `-oJ` saves JSONL (structured data, one object per line)
- `-ls` shows which sources subfinder can query
- `-s` selects only certain sources
- `-all` uses every available source

## Using subfinder 

Subfinder has more options that are useful once you’re comfortable with the basics. Let’s walk through them with examples:

**Enumerate subdomains (basic):**

```bash
subfinder -d vulnweb.com

```

Here’s what will happen next:

![basic.png](https://linuxhandbook.com/content/images/2025/09/basic.png)

Awesome, all the subdomains are now visible.

**Enumerate multiple domains from file:**

Runs against every domain listed in `domains.txt`.

```bash
subfinder -dL domains.txt

```

**Use all sources:**

Queries every source subfinder knows about. Slower, but more complete.

```bash
subfinder -d vulnweb.com -all

```

**Exclude specific sources:**

```bash
subfinder -d vulnweb.com -es alienvault,zoomeyeapi

```

Skips certain sources if you don’t want to use them.

**Set concurrency (threads):**

```bash
subfinder -d vulnweb.com -o results.txt -t 50

```

Runs with up to 50 concurrent tasks.

**Limit request rate:**

```bash
subfinder -d vulnweb.com -rl 50

```

Keeps requests under 50 per second.

**Output to a plain file:**

```bash
subfinder -d vulnweb.com -o results.txt

```

**JSON output:**

```bash
subfinder -d vulnweb.com -oJ vulnweb.jsonl

```

**CSV output (via quick conversion):**

```bash
subfinder -d vulnweb.com -oJ subfinder.jsonl
jq -r '.name' subfinder.jsonl | awk 'BEGIN{print "subdomain"}{print $0}' > subfinder.csv

```

![output-blured.png](https://linuxhandbook.com/content/images/2025/09/output-blured.png)

The output has been saved to `subfinder.csv`. Open it to view the data.

**Unique results only:**

```bash
subfinder -d vulnweb.com -silent -o results.txt
sort -u results.txt > results_unique.txt

```

**Recursive enumeration (find deeper subdomains):**

```bash
subfinder -d vulnweb.com -recursive

```

## Provider configuration (optional but powerful)

You can add API keys of premium services like [SecurityTrails](https://securitytrails.com/?ref=linuxhandbook.com), [Shodan](https://www.shodan.io/?ref=linuxhandbook.com) etc. They will give you richer results. You can add keys to `~/.config/subfinder/provider-config.yaml`:

```yaml
securitytrails:
  key: "YOUR_SECURITYTRAILS_API_KEY"
virustotal:
  key: "YOUR_VIRUSTOTAL_API_KEY"
shodan:
  key: "YOUR_SHODAN_API_KEY"

```

You can use subfinder without keys, but adding them usually gives us more coverage.

## Simple practice exercise with vulnweb.com

Let's get into practice mode and run a few simple coommands to explore subfinder:

Collect subdomains:

```bash
subfinder -d vulnweb.com -silent -o vulnweb_raw.txt

```

![exercise-1.png](https://linuxhandbook.com/content/images/2025/09/exercise-1.png)

Clean up duplicates:

```bash
sort -u vulnweb_raw.txt > vulnweb_clean.txt

```

The following command will create `vulnweb_clean.txt` with unique entries:

![exercise-2.png](https://linuxhandbook.com/content/images/2025/09/exercise-2.png)

Done! The cleaned list is in `vulnweb_clean.txt` — go check it out.

Next, save JSON output too (for reports):

```bash
subfinder -d vulnweb.com -oJ vulnweb.jsonl

```

![exercise-3-output-json.png](https://linuxhandbook.com/content/images/2025/09/exercise-3-output-json.png)

Take a look at the first 10 results:

```bash
head -n 10 vulnweb_clean.txt

```

![exercise-10-result.png](https://linuxhandbook.com/content/images/2025/09/exercise-10-result.png)

Now you have a tidy list of candidate subdomains, ready for the next step of vulnerability assessment.

## Final notes

Subfinder is the quiet scout in the toolkit. It doesn’t overwhelm us with noise, it just hands out the names that exist out in the wild. With a few simple commands, we can build a reliable subdomain list for any domain we’re testing.

For now, practice on vulnweb.com until you’re comfortable. Later, move on to checking which of those names are live and what services they’re running. But that’s another story for another day.