Repository navigation
Evaluate subfinder as potential amass replacement #2852
Description
Amass has been causing a lot of issue since the v4 release.
It seems that the general direction of the tool with its persistent database is not really in line with the tools that are easily supported by the scb. There also have been some bugs / features which have made it very hard to use amass as a reliable subdomain scanner in the SCB anymore.
As a alternative we should evaluate subfinder which seems to tick all the boxes for me that I'd need from a subdomain scanner without the hassle.
Reacted by Robert Felber
Metadata
Metadata
Assignees
Type
Projects
- Status
Activity
J12934 commentedon Jun 17, 2025
Would be cool if the subfinder parser would differentiate between two different categories of findings produced:
"Active Subdomains": Subdomains that still have dns records.
"Unverified Subdomain": Subdomains that come from the datasource but could not be verified if they are still active.
Weltraumschaf commentedon Jun 17, 2025
Recherche Perplexity:
Alternatives to Subfinder from ProjectDiscovery.io
Several tools offer subdomain enumeration capabilities similar to Subfinder. These alternatives vary in their approach, data sources, and additional features. Below is a summary of the most notable options:
Popular Open Source Alternatives
OWASP Amass
Amass is widely regarded as the leading alternative to Subfinder. It provides both passive and active subdomain enumeration, supports a wide array of data sources, and is suitable for in-depth reconnaissance and mapping of attack surfaces. Amass is free, open source, and available for Linux, online, and self-hosted deployments[6][3].
Sublist3r
Sublist3r is a Python-based tool that leverages search engines and public sources to enumerate subdomains. It is easy to use and popular among penetration testers and bug bounty hunters. Sublist3r also integrates Subbrute for brute-force subdomain discovery[3][6].
Assetfinder
Assetfinder is a Go-based tool that quickly finds subdomains using various sources, including Certspotter, Hackertarget, Facebook, and Virustotal. It is lightweight and straightforward, making it suitable for quick scans[3].
Knockpy
Knockpy is another subdomain enumeration tool that uses multiple sources and supports brute force discovery. It is a common choice for those seeking alternatives to Subfinder.
Anubis
Anubis aggregates subdomains from sources like HackerTarget, DNSDumpster, x509 certificates, VirusTotal, Google, and NetCraft. It is open source and provides both online and self-hosted options[6].
Lepus Subdomain Finder
Lepus is a utility for identifying and collecting subdomains for a given domain, offering a free and open-source solution[6].
Other Noteworthy Tools
SubdomainRadar
A proprietary, freemium online tool that offers advanced enumeration through exclusive data sources and real-time search capabilities[6].
OneForAll
Another subdomain enumeration tool, often used in research and bug bounty workflows, though less widely adopted than Amass or Sublist3r[3].
Chaos (ProjectDiscovery)
While not a direct alternative, Chaos is a ProjectDiscovery project that provides a large, regularly updated database of public subdomains, which can be queried via API or command line[3].
Comparison Table
Summary
If you are looking for alternatives to Subfinder, OWASP Amass and Sublist3r are the most popular open-source choices, each offering robust subdomain enumeration features. Assetfinder, Knockpy, Anubis, and Lepus also provide effective solutions, depending on your specific needs and preferred programming language[6][3]. Proprietary tools like SubdomainRadar may offer unique data sources or features for those seeking commercial options.
Sources
[1] projectdiscovery/subfinder: Fast passive subdomain enumeration tool. https://github.com/projectdiscovery/subfinder
[2] ProjectDiscovery's Best Kept Secrets https://projectdiscovery.io/blog/projectdiscovery-best-kept-secrets
[3] Subdomains : Effective Research Methods - Bilal's blog https://blog.fikara.io/subdomain-enumeration
[4] projectdiscovery/shuffledns - GitHub https://github.com/projectdiscovery/shuffledns
[5] Using Subfinder with Netlas Module - Netlas Blog https://netlas.io/blog/netlas_and_subfinder/
[6] Subfinder Alternatives and Similar Software | AlternativeTo https://alternativeto.net/software/subfinder/
[7] Subfinder Cheat Sheet - HighOn.Coffee https://highon.coffee/blog/subfinder-cheat-sheet/
[8] Top ProjectDiscovery Alternatives in 2025 - Slashdot https://slashdot.org/software/p/ProjectDiscovery/alternatives
[9] The Ultimate Guide to Finding Bugs With Nuclei - Project Discovery https://projectdiscovery.io/blog/ultimate-nuclei-guide
[10] Hacking Beyond.com — Enumerating Private TLDs - Google Cloud https://cloud.google.com/blog/topics/threat-intelligence/enumerating-private-tlds
[11] Recon with Me !!! – Geek Freak https://dhiyaneshgeek.github.io/bug/bounty/2020/02/06/recon-with-me/
[12] Introducing Alterx: Efficient Active Subdomain Enumeration with ... https://projectdiscovery.io/blog/introducing-alterx-simplifying-active-subdomain-enumeration-with-patterns
[13] How to use Uncover: Quickly discover exposed hosts using multiple ... https://projectdiscovery.io/blog/uncover