projectdiscovery/subfinder

Features

• Attack Surface Management - Maps internet-exposed infrastructure and cloud assets to maintain visibility into an organization's total attack surface.
• Cloud Asset Discoverers - Identifies and inventories internet-exposed and cloud-hosted infrastructure assets.
• Configuration-Driven Scanning Engines - Executes modular security checks by interpreting YAML-based detection logic against target assets.
• Domain-Based Discoverers - Identifies and monitors subdomains, IP addresses, and network ranges by scanning root domains.
• Attack Surface Mappers - Identifies and catalogs internet-facing infrastructure to provide visibility into the total attack surface.
• Infrastructure Reconnaissance - Automates the collection of domain associations, IP addresses, and network ranges to support security reconnaissance.
• Subdomain Enumeration Tools - Identifies subdomains using passive online sources to expand the attack surface during security reconnaissance.
• Reconnaissance and Assessment Platforms - Acts as a modular framework for mapping attack surfaces through automated asset discovery, subdomain enumeration, and infrastructure intelligence gathering.
• Vulnerability Scanning - Identifies security weaknesses by matching target infrastructure against a library of known vulnerability templates.
• Web Crawling - Navigates websites to discover endpoints and hidden details by parsing page content and following links across various web technologies.
• Cloud Asset Inventory Managers - Catalogs and monitors internal and cloud-based network resources to ensure an accurate inventory of organizational assets.
• Asset Discovery Tools - Identifies and catalogs internet-facing infrastructure and cloud-hosted assets to maintain a comprehensive security inventory.
• Vulnerability Scanners - Automates vulnerability detection by executing reusable security checks across multiple hosts.
• Cloud Infrastructure - Maps and monitors cloud-hosted infrastructure assets across multiple service providers.
• Cloud Synchronizers - Maintains an up-to-date infrastructure inventory by connecting directly to cloud provider accounts.
• Domain Correlation - Discovers related domains by correlating acquisition history, certificate logs, and registration records.
• Parallel Security Scanners - Performs high-speed, multi-protocol security assessments across large target sets by leveraging cloud-native infrastructure to maximize throughput and coverage.
• Port Scanners - Scans network ports to identify open services and determine network exposure.
• Cloud Security Monitoring - Connects to cloud provider accounts to continuously assess and identify security risks within hosted environments.
• Automated Discovery Workflows - Triggers automated discovery workflows across domains using DNS, port scanning, and HTTP probing.
• AI Template Generators - Generates custom security scanning templates using AI to identify vulnerabilities based on specific requirements.
• Out-of-Band Interaction Monitoring - Detects blind vulnerabilities by monitoring asynchronous DNS, HTTP, and protocol callbacks.
• Template Synchronization - Integrates community-contributed security templates to ensure rapid response to emerging threats and vulnerabilities.
• Out-of-Band Testing - Configures out-of-band testing to detect blind vulnerabilities via asynchronous network callbacks.
• Interaction Monitoring - Captures asynchronous network callbacks to identify blind vulnerabilities and server-side request forgery.
• Automated Security Scan Triggers - Automatically triggers security scans based on asset discovery and infrastructure changes to maintain continuous coverage.
• Web Asset Probing - Performs active probing and fingerprinting of web assets to generate actionable security intelligence.
• Web Path Bruteforcing - Probes specific URL paths across multiple targets to identify accessible endpoints, status codes, and potentially unsecured or sensitive resources.
• Web Technology Detection - Automates the fingerprinting of web technologies and frameworks running on discovered infrastructure.
• Command Line Tools - Listed in the “Command Line Tools” section of the The Book Of Secret Knowledge awesome list.
• Subdomain Enumeration - Fast passive subdomain discovery from multiple sources.
• Subdomain Enumeration Tools - Passive subdomain discovery using online resources.
• Open Source Intelligence - Fast passive subdomain enumeration using public sources.
• Workflow Scanning - Triggers and manages security scans programmatically via REST API for integration into development pipelines.
• Internal Network Discoverers - Identifies internal network assets to build an accurate inventory for security analysis.
• Crawl Boundary Controls - Adjusts concurrency, rate limits, and scope to control the speed and breadth of discovery processes.
• Distributed Scanning Agents - Scales discovery tasks by distributing workloads across multiple remote scanning agents.
• Distributed Task Orchestration - Scales discovery and assessment tasks by parallelizing workloads across multiple remote nodes.
• Scan Orchestration - Orchestrates automated security assessments, including configuration, scheduling, and scan definition management.
• Relationship Visualizers - Maps complex connections between assets and attack paths to visualize the organizational attack surface.
• DNS Reconnaissance - Retrieves historical and active subdomain data from internet-wide datasets for reconnaissance.
• DNS Record Resolvers - Queries DNS record types like A, CNAME, and ASN to verify domain existence.
• Domain Name Systems - Translates domain names into IP addresses using multiple protocols and custom resolvers.
• Mappers - Maps network infrastructure by correlating IP ranges and autonomous system numbers to uncover organizational assets.
• Credential Monitoring Services - Detects and alerts on leaked login information from dark web sources and malware logs to identify potential security exposures.
• Exposed Host Discoverers - Search public APIs and services to locate hosts that may be inadvertently exposed to the internet.
• Infrastructure Misconfiguration Detectors - Identifies security findings such as dangling DNS records or exposed origin IP addresses during asset enumeration.
• Security Automation Templates - Provides a centralized system for creating, retrieving, and sharing automated security testing templates.
• Security Finding Management - Monitors identified security weaknesses, tracks retest outcomes, and maintains historical logs of discovered issues.
• Security Payload Generators - Generates unique payloads to detect blind vulnerabilities via out-of-band interactions.
• Vulnerability Monitoring Systems - Performs recurring security checks to monitor identified vulnerabilities and maintain an up-to-date security posture.
• Data Leak Monitors - Detects and tracks exposed domains, email addresses, and other sensitive information associated with an organization.
• Headless Browsers - Uses automated browser engines to execute client-side JavaScript and capture visual state for web analysis.
• Asset Discovery Filters - Filters discovered assets based on custom criteria and provider metadata to focus security analysis.
• Asset Inventory Management - Tracks updates to domain ownership and certificate issuance to maintain an accurate asset inventory.
• Automated Labelers - Automatically applies tags to discovered assets based on risk profiles to streamline security management.
• REST APIs - Exposes REST endpoints for programmatic access to templates, scan triggers, and AI generation capabilities.
• Scan Configurations - Defines custom scan workflows using templates, headers, and rate limits.
• Team Management - Organizes users into teams where administrators can invite members, update team details, and manage access permissions.
• Visual Capture Tools - Uses headless browsers to generate screenshots and capture rendered DOM for visual analysis.
• Self-Hosted Deployment Infrastructure - Supports deploying self-hosted infrastructure for specialized protocol listeners and security testing.
• Scan Result Exporters - Exports enumeration results into structured formats like JSON or CSV for external integration.
• Network Origin Mapping - Resolves network ranges and autonomous system numbers to map organizational infrastructure.
• DNS Query Filters - Filters DNS results to isolate relevant network records and exclude noise during enumeration.
• Wildcard Domain Detectors - Filters out wildcard DNS responses to prevent false positives during large-scale enumeration.
• Network Connectivity Configurations - Customizes connection behavior and protocols to ensure accurate service discovery across diverse network environments.
• Network Scanning Tools - Executes internal network scans to identify services and vulnerabilities within private subnets.
• API Access Security - Allows for the revocation of authentication keys to secure platform services and prevent unauthorized access.
• API Key Authentication - Provides mechanisms to request and manage unique authentication tokens for programmatic platform access.
• Credential Rotators - Supports the rotation of authentication tokens to maintain secure access to platform services.
• Infrastructure Fingerprinters - Analyzes TLS configurations, ASN affiliations, and favicon hashes to categorize and map the underlying infrastructure of target web servers.
• Origin Exposure Detection - Detects misconfigured CDN hostnames that reveal underlying origin IP addresses.
• Scan Filtering Tools - Filters infrastructure assets to prioritize critical systems during security scans.
• Security Vulnerability Reporting - Exports detailed vulnerability data for external analysis and reporting.
• Vulnerability Data Query Engines - Searches and filters vulnerability databases using criteria like product, vendor, severity, and CVSS score to identify relevant security issues.
• Enumeration Task Triggers - Trigger a new execution of a previously completed discovery task to refresh results using the original configuration and parameters.
• Subdomain Enrichment Utilities - Automatically expands and enriches subdomain wordlists to improve discovery coverage.
• Exploitability Validation - Simulates real-world attacks at runtime to confirm the exploitability of identified security vulnerabilities.
• Contextual Vulnerability Analysis - Outputs structured vulnerability details for integration into automated analysis pipelines.
• Vulnerability Retesters - Triggers a new scan for a specific vulnerability to verify its current status or confirm that a remediation has been successfully applied.
• Wildcard Certificate Issuers - Filters out false-positive DNS records caused by wildcard configurations to ensure accurate discovery.
• Wildcard DNS Filters - Identifies and removes false-positive subdomains caused by wildcard DNS configurations.
• Wordlist Generators - Generates custom subdomain wordlists by applying patterns and variables for tailored security enumeration.
• Security Tool Integrations - Integrates security findings into external workflows via standard input and output streams.
• Filtering Engines - Applies domain-specific language expressions to scan results for granular control over asset selection.
• Remediation Tracking - Tracks vulnerability status and synchronizes remediation efforts with external ticketing systems.
• Credential Leak Remediation Trackers - Tracks the status of identified credential exposures by allowing users to mark leaks as resolved or reopen them as needed.
• Hostname Permutation Generators - Generates targeted subdomain variations using naming patterns and dynamic payloads to improve discovery efficiency.
• System Activity Monitoring - Records significant system and user events to provide a comprehensive audit trail of organizational activity.
• Analysis Result Dashboards - Displays discovered web assets and status information through an integrated dashboard for monitoring.
• Recurring Agent Scheduling - Enables the cancellation of recurring automated scan tasks to stop future discovery executions.
• Automated Audit Schedulers - Configures recurring timetables for automated security assessments to ensure consistent monitoring.
• Member Permission Modifiers - Updates the access level and role of existing team members to adjust administrative capabilities.
• Asset Exporters - Enables exporting discovered assets and subdomains with filtering options for external analysis.
• Asset History Retrievers - Fetches a chronological log of changes for a specific asset, allowing filtering by time range and event type.
• Asset Management Policies - Enforces automated rules and policies for infrastructure assets based on defined conditions.
• Data Enrichment - Enriches host data with CDN and ASN context to provide deeper infrastructure intelligence.
• Standard Stream Integration - Processes discovery results through standard input and output streams for seamless tool integration.
• Automated Asset Management Systems - Executes automated actions like alerting or labeling on assets based on discovery criteria.
• Workflow Result Retrieval - Fetches collected asset discovery results using flexible filtering criteria.
• CLI Workflow Integrations - Integrates discovery data into external pipelines, containers, and reporting dashboards.
• External Security Tool Integrations - Integrates with external scanning tools to perform detailed service discovery and version detection.
• Scan Allowlist Managers - Limits security operations to only those targets that match specified inclusion patterns, automatically ignoring any assets that fall outside the defined scope.
• Task Scheduling - Automates the configuration of recurring re-scan intervals for discovery tasks to maintain current data.
• Workspace Team Creation - Initializes collaborative environments for managing security testing and vulnerability data within a centralized platform.
• Asset Metadata Management - Assigns descriptive labels to discovered infrastructure assets based on metadata and DNS analysis.
• Container Orchestration Platforms - Queries container orchestration platforms to retrieve asset information and maintain an accurate inventory.
• Scan Record Removers - Delete a specific subdomain discovery task from the cloud platform using its unique identifier to clean up historical data.
• Asset Exporters - Consolidates and exports unique assets identified during scans to facilitate further analysis.
• IPv6 Network Stacks - Supports scanning and network communication over both IPv4 and IPv6 protocols.
• DNS Utilities - Resolves domain names and identifies subdomains by querying various DNS records and passive data sources.
• Network Host Discoverers - Identifies active hosts on a network using various ping techniques like ARP, TCP, or ICMP before initiating port scans.
• Discovery Scope Restrictors - Limits asset discovery to specific allowlists of targets to override default behavior.
• Domain-Based Access Controls - Restricts platform access to verified organizational domains and mandates single sign-on.
• SSL/TLS Analyzers - Provides tools to inspect and analyze TLS certificate details and security configurations from target services.
• Credential Exposure Analyzers - Analyzes and reports on credential leak statistics for domains and email addresses to assess exposure.
• API Request Authentication - Validates API requests using unique keys to ensure secure programmatic communication.
• Integration Detail Retrieval - Provides APIs for retrieving detailed metadata and remediation steps for identified security vulnerabilities.
• Private Network Security - Performs automated vulnerability assessments and continuous monitoring on private network segments.
• Private Template Managers - Stores and synchronizes security templates in a cloud environment for collaborative access.
• Role-Based Access Control - Assigns permission levels to users to control access to administrative and operational features.
• Target Exclusions - Provides mechanisms to exclude specific ports, CDNs, or WAFs from security scan results.
• Security Scan Exclusions - Prevents specific targets or templates from being included in security scans by defining global or scope-specific exclusion rules.
• Vulnerability Context Enrichers - Enriches vulnerability records by linking them to external data sources including exploit scores, known exploited vulnerabilities, and security reports.
• Vulnerability Databases - Provides a structured interface to search and navigate common vulnerability and exposure records.
• Credential Leak Databases - Consolidates and retrieves records of exposed personal or employee data from multiple sources for security analysis.
• Enumeration Configuration Managers - Refines subdomain discovery scope by updating parameters and scanning steps.
• Threat Notification Systems - Sends automated alerts regarding newly detected vulnerabilities or trending exploits to keep security teams and leadership informed.
• Exposure Monitoring - Retrieves and exports leaked credential data for integration with security workflows.
• Vulnerability Management - Retrieves chronological histories of vulnerabilities including discovery, template releases, and status changes.
• Excluded Templates - Prevents specific subdomains, IP addresses, or wildcard patterns from being processed during automated, manual, or scheduled security scans.
• Request Throttling - Limits request rates to target hosts to balance scan speed with network impact.
• Crawling Request Throttlers - Manages network load by configuring concurrency and request rate limits during large-scale discovery operations.
• Alert Notification Systems - Streams real-time security notifications and tool output to multiple communication platforms.
• Alert Routing - Sends automated notifications about discovery findings to external communication platforms for team awareness.
• Audit Log Filters - Filters and analyzes audit logs to investigate security activities.
• Discovery Result Exporters - Exports discovered subdomain data into structured formats like JSON or plain text for external analysis.
• Observability Platform Log Exporting - Streams audit logs to external security information and event management platforms.
• Resource Change Monitors - Tracks infrastructure drift and new endpoints continuously to ensure visibility into evolving environments and prevent security gaps.
• HTTP Response Handling - Configures dynamic HTTP responses to simulate service behaviors for security verification.

Star history