Have you ever wanted to discover all the subdomains for a given domain?
If you search on Google for tools that find all subdomains, you usually end up on sites with captchas and rate limits.
I discovered subfinder today.
subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.
You simply run subfinder -d <target domain>, and it spits out a list of the public subdomains it discovers.
Finding all subdomains can be useful for pen-testing and security hardening your network.
