subfinder: build a subdomain inventory from passive sources

The list attackers already have

Certificate transparency logs, passive DNS archives, and search engines record hostnames long after a team forgets them. subfinder asks those sources for names under one domain and prints what comes back. It never resolves the names or sends traffic to your servers, so a run tells you what outsiders can learn for free.

The point for a defender is the gap. Every name in the passive list that is missing from your DNS inventory or your asset register is either stale history or a host nobody owns any more.

A first run with sources kept

Install the binary from the ProjectDiscovery releases page or with go install. Many sources work without keys; others, such as SecurityTrails or Censys, need an API key in ~/.config/subfinder/provider-config.yaml. Keep that file readable only by your user.

-all asks every configured source, -cs prints which source reported each name, and -oJ writes one JSON object per line so the result can be joined with other data later.

subfinder -d hackblue-lab.org -all -cs -silent

subfinder -d hackblue-lab.org -all -oJ -o subs.jsonl
jq -r '.host' subs.jsonl | sort -u > passive.txt
wc -l passive.txt

What the output looks like

With -cs each line pairs a hostname with the sources that reported it. A name seen only in an old certificate log is weaker evidence than one that passive DNS saw last week.

api.hackblue-lab.org,[crtsh certspotter]
staging.hackblue-lab.org,[crtsh]
old-billing.hackblue-lab.org,[crtsh anubis]
vpn.hackblue-lab.org,[hackertarget crtsh]
www.hackblue-lab.org,[crtsh alienvault]

Worked case: the billing host nobody remembered

The DNS export from the registrar has 41 records. subfinder returns 58 names. Running comm -13 on the two sorted lists leaves 17 names that DNS does not know. Most are certificates for hosts that were renamed. One, old-billing, still has a CNAME at a third-party host that the finance team cancelled last year.

That CNAME is the finding: a dangling record that someone else could claim at the provider. The fix is to delete the record, and to add “remove DNS” to the offboarding checklist for that vendor.

sort -u dns-export.txt > dns.txt
comm -13 dns.txt passive.txt > only-in-passive.txt
dig +short CNAME old-billing.hackblue-lab.org