← All Cheatsheets
recon

Subfinder & Amass — Subdomain Enumeration

Passive and active subdomain enumeration with Subfinder and Amass.

9 views Apr 2026 lazyhackers
Subfinder (8)
subfinder -d target.com
Basic subdomain enumeration
subfinder basic
subfinder -d target.com -o subdomains.txt
Save results to file
subfinder output
subfinder -d target.com -v
Verbose mode — show source of each subdomain
subfinder verbose
subfinder -d target.com -all
Use all sources (slower but more results)
subfinder all
subfinder -d target.com -recursive
Recursive subdomain enumeration
subfinder recursive
subfinder -dL domains.txt -o results.txt
Enumerate subdomains for multiple domains
subfinder bulk
subfinder -d target.com -t 50 -timeout 30
Custom threads and timeout
subfinder speed
subfinder -d target.com -pc ~/.config/subfinder/provider-config.yaml
Use API keys config file
subfinder api
Amass Enum (8)
amass enum -d target.com
Basic passive enumeration
amass passive
amass enum -active -d target.com
Active enumeration (DNS brute force + passive)
amass active
amass enum -d target.com -o amass_out.txt
Save output to file
amass output
amass enum -d target.com -brute -w /usr/share/seclists/Discovery/DNS/deepmagic.com-prefixes-top50000.txt
DNS brute force with wordlist
amass bruteforce dns
amass enum -d target.com -src -ip
Show source + IP for each subdomain
amass ip
amass enum -d target.com -max-dns-queries 5000
Limit DNS queries per second
amass speed
amass intel -whois -d target.com
WHOIS-based org/ASN intel gathering
amass intel whois
amass intel -asn 12345 -ip
Enumerate domains owned by ASN
amass asn intel
Post-Processing & Chaining (5)
subfinder -d target.com | httpx -silent -o live_hosts.txt
Find live HTTP hosts from subdomains
httpx live chain
subfinder -d target.com | httpx -title -tech-detect -status-code
Get title, tech stack, status for each subdomain
httpx recon
cat subdomains.txt | dnsx -a -resp -o resolved.txt
Resolve subdomains to IPs with dnsx
dnsx resolve
cat subdomains.txt | sort -u > unique.txt
Deduplicate subdomain list
process
amass enum -d target.com -o amass.txt && subfinder -d target.com -o sub.txt && cat amass.txt sub.txt | sort -u > all_subs.txt
Combine Amass + Subfinder results
combine chain