Subfinder

Subfinder is an open-source subdomain discovery tool used in security reconnaissance — it passively enumerates subdomains of a target domain by querying multiple public data sources (certificate transparency logs, DNS databases, search engines) rather than brute-forcing.

Because it's passive (no direct requests to the target that would appear in their logs), it's a common first step in a security assessment or bug bounty workflow for mapping a target's attack surface before more active testing begins.

Part of the ProjectDiscovery toolset, commonly chained with other recon tools (httpx, nuclei) in an automated reconnaissance pipeline.