How to find all subdomains for a domain

Have you ever wanted to discover all the subdomains for a given domain?

If you search on Google for tools that find all subdomains, you usually end up on sites with captchas and rate limits.

I discovered subfinder today.

subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.

You simply run subfinder -d <target domain>, and it spits out a list of the public subdomains it discovers.

Finding all subdomains can be useful for pen-testing and security hardening your network.

---