An in-depth guide to subfinder: beginner to advanced

In the era of application security, bug bounties have evolved and become mainstream for hackers around the globe. Hackers are constantly looking for new tactics to automate the process of reconnaissance and find different types of vulnerabilities. One of the first steps to hacking a larger scoped program is subdomain enumeration.

You can find subdomains by using tools like amass, assetfinder, sudomy, and others. However, in this post, we'll discuss one of the most popular, subfinder, from ProjectDiscovery.

Introduction To Subfinder

Subfinder is a popular open-source tool used for subdomain enumeration. It allows users to quickly and easily discover subdomains of a given domain by using a variety of different active and passive methods. This can be useful for a variety of purposes, such as security assessments, penetration testing, and research.

There are several similar tools available, including Sublist3r, Knockpy, and Amass. However, Subfinder is generally considered to be one of the most effective due to its speed, active development and the strong community. Subfinder is written in Golang, making full use of Golang's native concurrency to gather subdomains from multiple sources simultaneously. Subfinder gathers potential subdomain lists from passive online sources such as Binaryedge, C99, Certspotter, Chinaz, Censys, Chaos, and others.

Core Features

Below are some of Subfinder's core features:

• Fast and powerful resolution and wildcard elimination module
• Curated passive sources to maximize results
• Multiple Output formats supported (JSON, File, Stdout)
• Optimized for speed, very fast and lightweight on resources
• STDIN/OUT support for integrating with workflows
• Command Line Interface (CLI) based tool
• Easy API configuration interface
• Ability to exclude certain sources
• Uses up to 26 passive DNS sources (including SecurityTrails!)
• Docker, tar and pre-built binaries available

The ProjectDiscovery Community Factor

The ProjectDiscovery community is a major factor in the success of Subfinder, and has helped to make it one of the most popular tools for subdomain enumeration. Their passion and engagement have helped to drive the development of the tool and ensure that it continues to meet their needs, including penetration testing, security research and bug bounty hunting.

The ProjectDiscovery community plays a crucial role in the development and success of Subfinder and other tools. They provide valuable feedback and suggestions for improving the tool, contribute code and other resources to the project, develop content related to the tool, and help to battle test it.

Table of Contents

• Installation of Subfinder
• Navigating through Subfinder
• Output Options
• Advanced Options
• Post Installation Instructions
• Conclusion

Installation of Subfinder

We can install Subfinder using four different methods:

Source

Subfinder is written in Golang. Therefore, we can install it from source by using Golang utilities. To achieve that, you'll need to install Go on your local machine.

Binary

First, download the release that is compatible with your operating system, to get started. Then unzip the folder, and move the subfinder binary file to /usr/local/bin.

GitHub

Clone the repository at repo and change to subfinder/v2/cmd/subfinder. Now run go build .. Subfinder is now available for use after the binary file has been moved to /usr/local/bin.

Docker

Navigating through Subfinder

In this section, we will cover all the different features and usage options that Subfinder provides.

Getting Help

Performing Basic Subdomain Enumeration

Enumerating Subdomains From a List of Domains

Enumerating Subdomains Using Specific Sources

The screenshot below shows how we retrieved the subdomains using the virustotal API Key. To retrieve subdomains from other alternative sources, the API Keys must be added to the file ~/.config/subfinder/provider-config.yaml. You can learn more about these API keys below in the Post Installation Instructions section.

The example of sample API Keys has being shown in the screenshot below:

Enumerating Subdomains Using All Sources

Using the -all option, we can fetch all the subdomains using the default sources and sources with configured API Keys.

Excluding Specific Sources

The -es option allows you to exclude specific sources. The total count of subdomains decreases significantly. The domain count originally with all sources was more than 854 domains.

After removing these sources, the picture below only displays the 559 domains.

Output Options

Outputting Results to a File

Outputting Results in JSON Format

In the example below, we've utilized JQ to transform JSON data into a format that is easier to read. Using the head command, we can obtain the first ten lines of the tesla.json file.

Specifying a Directory to Write the Output

To supply a list of domains for subdomain enumeration, the -oD option is used in conjunction with -dL. As you can see in the picture shown below, when the command has been performed, a directory containing the appropriate files is created.

Only Displaying Active Subdomains

The option -nW performs DNS resolution on discovered subdomains, and discards any that don't respond. Use of the JSON output requires this parameter. It makes domain resolving easier, completing that part of your reconnaissance in one step.

Hiding Unnecessary Output

Being More Verbose

Advanced Options

Viewing Available Sources

Setting a Timeout

Piping to/from Other Tools

Subfinder accepts root domains from STDIN, like this:

Specifying a DNS Resolver

Specifying a List of DNS Resolvers

Post Installation Instructions

Subfinder will function after following the installation instructions. However, API keys need to be set up for Subfinder to function with certain services that have been customized. Without an API key, the following services will not function: Binaryedge, C99, Certspotter, Chinaz, Censys, Chaos, DnsDB, Fofa, Github, Intelx, Passivetotal, Robtex, SecurityTrails, Shodan, Threatbook, Virustotal, WhoisXML API, Zoomeye.

When you first run the program, a file called $HOME/.config/subfinder/provider-config.yaml will be produced that contains these settings. The configuration file is formatted in YAML. Each of these services allows the specification of multiple API keys, one of which will be used for enumeration.

For sources like Censys and Passivetotal that need several keys, you may add them by separating them with a colon (:).

Conclusion

Subfinder is a fantastic tool for gathering subdomains from various passive sources. It is straightforward to use and does not require much configuration. Due to its extensive integrations, it is far more powerful than most other subdomain mapping solutions currently available. Additionally, because it is implemented in the Go programming language, it is fast. Subfinder is unquestionably among the finest choices for bounty seekers while hunting for subdomains.

Author - Devansh Bordia, @devansh3008

References

• https://hakin9.org/subfinder-is-a-subdomain-discovery-tool-that-discovers-valid-subdomains-for-websites/
• https://securitytrails.com/blog/subfinder
• https://www.geeksforgeeks.org/subfinder-tool-in-linux/
• https://lipsonthomas.com/subfinder-subdomain-enumeration-tool/
• https://medium.com/bug-bounty/tagged/subfinder