performing-subdomain-enumeration-with-subfinder

# Performing Subdomain Enumeration with Subfinder ## When to Use - During the reconnaissance phase of penetration testing or bug bounty hunting - When mapping the external attack surface of a target organization - Before performing vulnerability scanning on discovered subdomains - When building an asset inventory for continuous security monitoring - During red team engagements requiring passive information gathering ## Prerequisites - Go 1.21+ installed for building from source - Subfinder v2 installed (`go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest`) - API keys configured for passive sources (Shodan, Censys, VirusTotal, SecurityTrails, Chaos) - Provider configuration file at `$HOME/.config/subfinder/provider-config.yaml` - Network access to passive DNS and certificate transparency sources - httpx or httprobe for validating discovered subdomains ## Workflow ### Step 1 — Install and Configure Subfinder ```bash # Install subfinder go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest # Verify installation subfinder -version # Configure API keys for enhanced results mkdir -p $HOME/.config/subfinder cat > $HOME/.config/subfinder/provider-config.yaml << 'EOF' shodan: - YOUR_SHODAN_API_KEY censys: - YOUR_CENSYS_API_ID:YOUR_CENSYS_API_SECRET virustotal: - YOUR_VT_API_KEY securitytrails: - YOUR_ST_API_KEY chaos: - YOUR_CHAOS_API_KEY EOF ``` ### Step 2 — Run Basic Subdomain Enumeration ```bash # Single domain enumera...