1

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

1

brew install subfinder

1

docker pull projectdiscovery/subfinder:latest

1

subfinder -d example.com

1

subfinder -dL domains.txt

1

subfinder -d example.com -o subdomains.txt

1

subfinder -d example.com -json -o results.json

1

~/.config/subfinder/provider-config.yaml

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

# provider-config.yaml
binaryedge:
  - your-api-key
censys:
  - your-api-id:your-api-secret
chaos:
  - your-chaos-key
github:
  - your-github-token
  - another-github-token
hunter:
  - your-hunter-key
intelx:
  - your-intelx-key
securitytrails:
  - your-securitytrails-key
shodan:
  - your-shodan-key
virustotal:
  - your-virustotal-key

1
2
3
4
5

# 只使用特定來源
subfinder -d example.com -sources crtsh,dnsdumpster,hackertarget

# 排除來源
subfinder -d example.com -exclude-sources waybackarchive

1

subfinder -ls

1
2

# 設定超時和並行
subfinder -d example.com -timeout 30 -t 100

1
2

# 啟用遞迴模式
subfinder -d example.com -recursive -recursive-level 2

1
2
3
4
5
6
7
8

# 1. 子域名列舉
subfinder -d target.com -o subs.txt

# 2. 存活檢測
cat subs.txt | httpx -o alive.txt

# 3. 漏洞掃描
nuclei -l alive.txt -severity critical,high

1

subfinder -d target.com -silent | httpx -title -tech-detect -status-code

1

subfinder -d target.com -silent | naabu -p 80,443,8080,8443

1

subfinder -d target.com -silent | dnsx -a -resp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

#!/bin/bash
# recon.sh

TARGET=$1
OUTDIR="recon/${TARGET}"
mkdir -p $OUTDIR

echo "[*] Subdomain enumeration..."
subfinder -d $TARGET -all -o $OUTDIR/subdomains.txt

echo "[*] Checking alive hosts..."
cat $OUTDIR/subdomains.txt | httpx -silent -o $OUTDIR/alive.txt

echo "[*] Screenshot capture..."
cat $OUTDIR/alive.txt | gowitness file -f -

echo "[*] Vulnerability scanning..."
nuclei -l $OUTDIR/alive.txt -severity critical,high -o $OUTDIR/vulns.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

#!/bin/bash
# monitor.sh

TARGET=$1
NEW_SUBS=$(mktemp)

subfinder -d $TARGET -silent > $NEW_SUBS

# 比對新發現的子域名
comm -13 <(sort old_subs.txt) <(sort $NEW_SUBS) > new_found.txt

if [ -s new_found.txt ]; then
    echo "New subdomains found:"
    cat new_found.txt
    # 發送通知
fi

mv $NEW_SUBS old_subs.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# .github/workflows/recon.yml
name: Subdomain Monitoring
on:
  schedule:
    - cron: '0 0 * * *'
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Subfinder
        run: |
          go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
          subfinder -d example.com -o subdomains.txt          
      - name: Upload Results
        uses: actions/upload-artifact@v4
        with:
          name: subdomains
          path: subdomains.txt

1
2
3
4

subfinder -d example.com
# api.example.com
# www.example.com
# mail.example.com

1
2

subfinder -d example.com -json
# {"host":"api.example.com","source":"crtsh"}

1
2
3

subfinder -d example.com -cs -all
# api.example.com,crtsh
# www.example.com,dnsdumpster