Subdomain Enumeration with Subfinder
Performs passive subdomain discovery to map external attack surfaces using ProjectDiscovery's Subfinder tool.
This skill empowers AI agents to automate the reconnaissance phase of security assessments by integrating Subfinder, a powerful passive subdomain discovery engine. It provides a structured workflow for identifying subdomains via certificate transparency logs and DNS aggregators without directly querying target servers, ensuring stealthy information gathering. By configuring multiple API providers and piping results into validation tools like httpx, users can build comprehensive asset inventories, identify forgotten staging environments, and uncover potential entry points for penetration testing or bug bounty hunting.
Key Features
014,120 GitHub stars
02Recursive enumeration for deep mapping of complex domain structures
03Automated installation and configuration of the Subfinder environment
04Flexible output management including JSON formats for programmatic pipelines
05Passive discovery via multiple API providers like Shodan, Censys, and VirusTotal
06Seamless integration with httpx and nuclei for live host validation
Use Cases
01Continuous Attack Surface Management (CASM) for enterprise security monitoring
02Reconnaissance for Bug Bounty programs and professional penetration testing
03Discovery of shadow IT and misconfigured cloud assets across large organizations