Fast passive subdomain enumeration
ProjectDiscovery's subdomain discovery tool that queries passive online sources, built for speed and easy chaining with other tools.
Subfinder finds valid subdomains of a target using passive sources such as certificate transparency logs, search engines and DNS datasets, without sending traffic to the target itself. Many sources need free or paid API keys configured in its provider file.
Its plain or JSON output is designed to pipe into other tools such as httpx and Nuclei.
MIT · MIT License · Open source
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: MIT.
No published advisory found for Subfinder in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
OSINT automation for footprinting
OSINT automation tool with a web UI and more than 200 modules that gather data on IPs, domains, emails, names and more from public sources.
Gather emails, names and subdomains from public sources
Python OSINT tool that collects emails, names, subdomains, IPs and URLs about a domain from search engines and public data sources.
Attack surface mapping and asset discovery
OWASP project for in-depth attack surface mapping: discovers domains, subdomains, IP ranges and related assets using DNS and many public data sources.
Asynchronous TCP port scanner for large ranges
Internet-scale port scanner that sends SYN packets asynchronously with its own TCP/IP stack, designed to scan very large address ranges quickly.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
