Hello, everyone, and welcome to this video.
So in this video, we are going to see how can we install a sub finder.
So subfinder is one of the most interesting tool that has been released by Project Discovery team, which
is used for identification of a subdomains for bug bounty programs.
Now, the installation is very, very simple.
And the best thing about this tool, as it is written in golang because of which it has much more faster
speed as well as concurrency, which means you can run multiple threads of this particular tool to identify
subdomains for multiple targets at once.
All right.
So how to do installation of this and how can we run this to identify subdomains very, very quickly?
So you need to come to this particular GitHub repository.
I'm going to give the link for this repository in the description.
Now, there are multiple ways that you can install it.
You can always compile it from the source code by copying this GitHub repository link and running this
manually.
Also, if you go into the releases tab, you will be able to identify the versions that are released
for each distribution.
For example, if you see over here, these are all the Linux versions that have been released for your
current distribution, you can download anyone that works perfectly fine for you, here it is MacOS
version, as well as Windows version.
So for me, I have downloaded the Mac OS AMD 64 version, as you can see over here.
So this is my version.
So let me just file this to show you that this is a Mac OS executable file, which can be seen over
here.
All right.
So now we are going to run this tool and let's see what kind of output do we get.
So before starting the tool, let's quickly see the documentation and the help guide.
So the first thing that need to be noticed over here is if you want to give any domain to identify it,
subdomains, you need to give the -d flag.
So Hyphen stands for that domain to find subdomains for.
So let's see this.
For instance, let's say we are going to identify the subdomains for a program which is Bugcrowd dot com
and hit enter.
Let's see how much time does it takes to identify the subdomains for bugcrowd and how many subdomains
it total identifies.
And you can see the scan is completed successfully and it has identified 31 subdomains for bugcrowd
in eight seconds.
This is pretty fast and we are getting a good result and output now in case you want to save
this into a file.
We can also do that.
There is a flag which is given over here, which is hyphen O to save the output or to write the output
into a file as can be seen over here.
So hyphe O and the file name, let's say we give the file name as bugcrowdsubs.txt and hit enter.
Now the output will be automatically saved into the file, which you can use later on for identification
or give it to any tool for further inspection or scanning.
So let us see if the file has been successfully created or not.
And you can see it has successfully created over here.
All right.
Now, let's say if you want to identify multiple subdomains for multiple target, not only one, in
that case, you can use the hyphen dL flag, which will enumerate the subdomains for all your target.
So let's see this.
So let's quickly make a file and let's call it as bounty target dot txt let's say our first target,
be hackerone and second target.
be bugcrowd dot com.
Let's save this quickly.
And now once we have saved this target, we are going to identify the subdomains for both the target.
So for that, we are going to write a sub finder hyphen small D Capital L.
As you can see over here, and bounty target
and hit enter ,when I will hit enter, you can see it, I started enumerating subdomains for hackerone.
So it has done enumerating the subdomains for Hackerone and it will start enumerating the subdomains for
bugcrowd as well.
Now you can see over here as we did a spell error and is not able to identify any subdomain for Hackerone
because we did not add dot com at the end.
So let's fix this quickly and write dot com over here.
And again, run this and let's see if we are able to identify this time more subdomains.
And you can see we are perfectly getting all the subdomains for the target as it has successfully identified
16 subdomains.
And previously, as we did a spell error, it was not able to identify it.
So you should also make note of this, that you also do not do similar kind of mistakes when you are
doing your bug bounty hunting or subdomain enumeration because you may get a false positive result which
will affect your hunting process.
So I hope you guys understood how you can use a subfinder to identify subdomains quickly, which you can
use later on for your hunting part.
Thank you.