Subfinder (T) alternatives
6 tools in the catalogue cover the same ground as Subfinder (T) and can replace it depending on the need. Each one is reachable, re-checked daily, and listed with its pricing.
- Amass (T)freeAdvanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.
- Phonebook.czfreeFree OSINT intelligence tool for enumerating subdomains, email addresses and URLs associated with a target domain by querying passive DNS and certificate data.
- DNS DumpsterfreeFree domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.
- crt.sh - Certificate SearchfreeCT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.
- AWSBucketDump (T)freePython tool that enumerates AWS S3 buckets and optionally downloads accessible objects using keyword and pattern-based discovery.
- cloud_enum (T)freeMulti-cloud enumeration tool that looks for exposed AWS, Azure, and GCP storage assets from target naming patterns.
Subfinder (T)
Cloud Infrastructure
Also written Subfinder
Fast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.
RECOMMENDED USE
Passive subdomain enumeration for cloud asset inventorying
Information
Video tutorials
Learn to use Subfinder (T)
Suggested workflow
Chain these tools in order for a complete investigation
Similar tools
These tools can also help you
cloud_enum (T)
Cloud InfrastructureMulti-cloud enumeration tool that looks for exposed AWS, Azure, and GCP storage assets from target naming patterns.
Amass (T)
Cloud InfrastructureAdvanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.
BucketLoot (T)
Cloud InfrastructureOpen-source cloud bucket discovery utility with limited current documentation and unclear maintenance signals.
GCPBucketBrute (T)
Cloud InfrastructureGoogle Cloud Storage bucket enumeration utility for identifying publicly accessible or weakly protected buckets.
User reviews
Be the first to leave a review