skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

subfinder-recon

Enumerates subdomains passively using subfinder with multi-source aggregation and pipeline integration.

1.7k|238|Updated Dec 7, 2019
Search Tags:#subdomain enumeration#attack surface#osint#recon#subfinder#projectdiscovery#passive reconnaissance
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill subfinder-recon
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: subfinder-recon
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/subfinder-recon
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill subfinder-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Discovering the full subdomain attack surface of a target domain is slow and incomplete when done manually, and active scanning generates detectable traffic. This Skill provides a structured methodology for passive subdomain enumeration with subfinder, aggregating 40+ data sources without touching the target.

Core Features & Use Cases

  • Passive Multi-Source Enumeration: Aggregate results from Shodan, Censys, SecurityTrails, VirusTotal, crtsh, and other sources with optional API key configuration for deeper coverage.
  • Pipeline Integration: Chain subfinder output directly into httpx for HTTP probing, naabu for port scanning, dnsx for DNS resolution, and nuclei for vulnerability scanning.
  • Batch and Recursive Modes: Process domain lists from files, run recursive discovery, and export results as plain text or JSON.
  • Use Case: During a pentest recon phase, run subfinder against a target domain, pipe live hosts through httpx, and feed the results into nuclei to identify critical vulnerabilities and subdomain takeover candidates in one command chain.

Quick Start

Ask the AI to enumerate all subdomains of a target domain using subfinder and check which ones are live over HTTP.

Frequently Asked Questions about subfinder-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains with subfinder?▼

Run subfinder with the -d flag followed by the target domain, adding -silent to output only subdomain names. For multiple domains, use -dL with a file containing one domain per line, and -o to save results to a file.

How to use subfinder with httpx for live host detection?▼

Pipe subfinder output directly into httpx: subfinder -d target.com -silent | httpx -silent. This filters discovered subdomains down to hosts with live HTTP services, and can be extended with nuclei for vulnerability scanning.

Does subfinder support API keys for more data sources?▼

Yes, subfinder supports API keys for sources like Shodan, Censys, and SecurityTrails. Add them to ~/.config/subfinder/provider-config.yaml to significantly improve enumeration coverage and result quality.

What is the difference between subfinder default and -all mode?▼

Default mode uses a curated set of fast, reliable sources for quick results. The -all flag queries every available source, producing more comprehensive results at the cost of slower execution.

Why does subfinder return few or no subdomains?▼

Sparse results usually mean missing API keys, since many high-value sources require authentication. Configure provider keys, try the -all flag for full source coverage, or use -recursive for deeper discovery on the target domain.

Related Skills

Explore More Software Engineering Skills→
zli5460zli5460
2

domain-intel

Perform passive OSINT domain analysis using DNS, WHOIS, SSL, and certificate transparency logs.

Community
Basic
woohyun212woohyun212
21

subdomain-takeover

Detect and verify subdomain takeover via dangling CNAME records.

Community
Advanced
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced