subfinder

Name: subfinder
Availability: InStock
Author: Dave

Enumerate subdomains for a target domain using passive OSINT sources.

15|1|Updated Feb 12, 2026

Search Tags:#reconnaissance #dns #enumeration #attack surface #osint #subdomain

Ready to run

npx skills add https://github.com/AeonDave/malskill --skill subfinder

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: subfinder
Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/recon/subfinder
Command: npx skills add https://github.com/AeonDave/malskill --skill subfinder

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automates the discovery of subdomains for a given domain, helping to map out the full attack surface and identify potential hidden hosts without directly interacting with the target.

Core Features & Use Cases

Passive OSINT: Leverages over 40 online sources to find subdomains.
Attack Surface Mapping: Essential for understanding a target's digital footprint.
Hidden Host Discovery: Uncovers subdomains that might not be easily found through other means.
Use Case: When asked to enumerate the attack surface of example.com, this Skill will provide a list of all known subdomains.

Quick Start

Use the subfinder skill to find all subdomains for the domain example.com and save them to a file named subs.txt.

Frequently Asked Questions about subfinder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I discover subdomains for a target domain without actively scanning it?▼

Passive subdomain enumeration discovers subdomains by querying over 40 public OSINT sources and online DNS databases, mapping the target's digital footprint without directly interacting with the target infrastructure.

What is passive subdomain enumeration and when do I need it for attack surface analysis?▼

Passive subdomain enumeration is the process of collecting subdomain records from public databases rather than sending direct probes to the target. You need it for attack surface analysis to identify hidden hosts and map infrastructure.

Can I use OSINT sources to find hidden hosts and map my attack surface?▼

Yes, you can use OSINT sources to find hidden hosts and map your attack surface by leveraging over 40 online databases to gather passive DNS records and uncover subdomains that are not easily visible through direct interaction.

How do I enumerate subdomains for example.com and save the output to a file?▼

To enumerate subdomains for example.com and save the output, run the passive enumeration task against the domain and direct the resulting list of discovered subdomain records to a text file like subs.txt.

Does passive DNS enumeration require any dependencies or active scanning tools?▼

Passive DNS enumeration requires the subfinder tool to query public DNS records and online databases, but it does not require active scanning tools since it relies entirely on querying over 40 public OSINT sources.

Why are my active scanning tools missing hidden subdomains compared to OSINT methods?▼

Active scanning tools miss hidden subdomains because they rely on direct interaction and probing, whereas OSINT methods aggregate historical and current DNS data from over 40 public databases to uncover subdomains passively.