子域名发现工具subfinder

https://github.com/projectdiscovery/subfinder/releases/tag/v2.6.3

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

docker pull projectdiscovery/subfinder:latest

git clone https://github.com/projectdiscovery/subfinder.git; cd subfinder/v2/cmd/subfinder; go build; mv subfinder /usr/local/bin/; subfinder -version;

https://github.com/projectdiscovery/subfinder/releases

subfinder -h

Usage:  ./subfinder [flags]
Flags:INPUT:  -d, -domain string[]  domains to find subdomains for  -dL, -list string     file containing list of domains for subdomain discovery
SOURCE:  -s, -sources string[]           specific sources to use for discovery (-s crtsh,github). Use -ls to display all available sources.  -recursive                      use only sources that can handle subdomains recursively (e.g. subdomain.domain.tld vs domain.tld)  -all                            use all sources for enumeration (slow)  -es, -exclude-sources string[]  sources to exclude from enumeration (-es alienvault,zoomeyeapi)
FILTER:  -m, -match string[]   subdomain or list of subdomain to match (file or comma separated)  -f, -filter string[]   subdomain or list of subdomain to filter (file or comma separated)
RATE-LIMIT:  -rl, -rate-limit int  maximum number of http requests to send per second  -rls value            maximum number of http requests to send per second four providers in key=value format (-rls "hackertarget=10/s,shodan=15/s")  -t int                number of concurrent goroutines for resolving (-active only) (default 10)
UPDATE:   -up, -update                 update subfinder to latest version   -duc, -disable-update-check  disable automatic subfinder update check
OUTPUT:  -o, -output string       file to write output to  -oJ, -json               write output in JSONL(ines) format  -oD, -output-dir string  directory to write output (-dL only)  -cs, -collect-sources    include all sources in the output (-json only)  -oI, -ip                 include host IP in output (-active only)
CONFIGURATION:  -config string                flag config file (default "$CONFIG/subfinder/config.yaml")  -pc, -provider-config string  provider config file (default "$CONFIG/subfinder/provider-config.yaml")  -r string[]                   comma separated list of resolvers to use  -rL, -rlist string            file containing list of resolvers to use  -nW, -active                  display active subdomains only  -proxy string                 http proxy to use with subfinder  -ei, -exclude-ip              exclude IPs from the list of domains
DEBUG:  -silent             show only subdomains in output  -version            show version of subfinder  -v                  show verbose output  -nc, -no-color      disable color in output  -ls, -list-sources  list all available sources
OPTIMIZATION:  -timeout int   seconds to wait before timing out (default 30)  -max-time int  minutes to wait for enumeration results (default 10)

subfinder.exe -d hackerone.com

resolvers:  - 1.1.1.1  - 1.0.0.1  - 8.8.8.8  - 8.8.4.4  - 9.9.9.9  - 9.9.9.10  - 77.88.8.8  - 77.88.8.1  - 208.67.222.222  - 208.67.220.220sources:  - archiveis  - binaryedge  - bufferover  - censys  - certspotter  - certspotterold  - commoncrawl  - crtsh  - digicert  - dnsdumpster  - entrust  - googleter  - hackertarget  - ipv4info  - passivetotal  - securitytrails  - shodan  - sitedossier  - threatcrowd  - threatminer  - urlscan  - virustotal  - waybackarchivebinaryedge: []censys: []certspotter: []passivetotal: []securitytrails: []shodan: []urlscan: []virustotal: []

subfinder.exe -config config.yaml -d example.com

subfinder.exe -d example.com -v