Subfinder

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network. No inbound application ports are needed. Outbound internet access over HTTPS is required so Subfinder can reach its passive sources.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Subfinder by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22).

Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:subfinder-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name subfinder \
  --image sac1647283583153:subfinder-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

There is no password and no console to log in to, because this product has no credentials at all. The file /etc/subfinder/credentials on the VM is an informational note that says so and points to the paths used in the steps below.

Step 4 - Confirm Subfinder is installed

Print the installed version:

subfinder -version

[INF] Current Version: v2.14.0

The command at /usr/local/bin/subfinder is a small SecureAnyCloud wrapper. It resolves the system provider-config at /etc/subfinder/provider-config.yaml, then hands off to the upstream binary at /usr/local/lib/subfinder/subfinder. Any API keys you add there apply in every context, not just a login shell.

Step 5 - Run a passive enumeration

Point Subfinder at a domain with -d. The -silent flag prints only the discovered subdomains, one per line. The example uses the canonical upstream self-test domain, which resolves entirely from free passive sources:

subfinder -silent -d hackerone.com | sort -u | head -20

a.ns.hackerone.com api.hackerone.com autodiscover.hackerone.com b.ns.hackerone.com docs.hackerone.com gslink.hackerone.com mail.hackerone.com mail2.hackerone.com managed.hackerone.com mta-sts.forwarding.hackerone.com mta-sts.hackerone.com mta-sts.managed.hackerone.com my.hackerone.com ns.hackerone.com ns2.hackerone.com ns3.hackerone.com support.hackerone.com websockets.hackerone.com www.hackerone.com

Nothing here touches the target, because every name comes from a public passive source. Replace hackerone.com with any domain you own or are engaged to test.

Step 6 - Optional: add passive-source API keys

The free sources need no keys. To unlock higher-volume or premium passive sources, add your own keys to the system provider-config. They then apply everywhere, including the scheduled timer and any CI job. Open the file in an editor:

sudo nano /etc/subfinder/provider-config.yaml

The file ships empty, with comments only, and has mode 0644 root:root. It holds your third-party keys, and no credential is baked into the image. See the Subfinder configuration docs for the format.

Step 7 - Scheduled attack-surface monitoring

subfinder-enum-run is the scheduled entry point. It reads /etc/subfinder/enum.conf and enumerates every domain in /etc/subfinder/targets.txt, or one domain you pass as an argument. It writes a JSONL report and a plain-text report, with latest-<domain>.* symlinks. Run it once by hand:

sudo subfinder-enum-run hackerone.com

[2026-07-19T13:37:26+0000] subfinder-enum-run: enumerating hackerone.com (passive) [2026-07-19T13:37:27+0000] subfinder-enum-run: hackerone.com: 24 subdomain(s) -> /var/lib/subfinder/reports/subfinder-hackerone.com-20260719T133726Z.txt

The reports directory keeps dated files plus stable symlinks that your CI can always read:

ls -l /var/lib/subfinder/reports/latest-hackerone.com.txt /var/lib/subfinder/reports/latest-hackerone.com.jsonl

The daily timer is enabled and armed out of the box. Check its schedule:

systemctl list-timers subfinder-enum.timer --no-pager

NEXT LEFT UNIT ACTIVATES Mon 2026-07-20 00:11:03 UTC 10h subfinder-enum.timer subfinder-enum.service

Step 8 - Configure your targets and read the JSONL reports

Add the domains you want monitored continuously to /etc/subfinder/targets.txt, one per line. The file ships empty. This command lists its active entries:

grep -vE '^[[:space:]]*#' /etc/subfinder/targets.txt | grep . || echo '(empty - add one domain per line)'

The appliance configuration lives in /etc/subfinder/enum.conf. Print its active settings:

grep -vE '^[[:space:]]*#' /etc/subfinder/enum.conf | grep .

TARGETS_FILE="/etc/subfinder/targets.txt" REPORT_DIR="/var/lib/subfinder/reports" SOURCE_TIMEOUT=30 MAX_TIME_MINUTES=10 REPORT_RETENTION_DAYS=30

Each JSONL report holds one JSON object per discovered subdomain. You can pipe it straight into jq or the next tool in your recon chain:

sudo subfinder-enum-run hackerone.com >/dev/null 2>&1; head -2 /var/lib/subfinder/reports/latest-hackerone.com.jsonl

{"host":"api.hackerone.com","input":"hackerone.com","source":"submd"} {"host":"autodiscover.hackerone.com","input":"hackerone.com","source":"submd"}

Configuration

All settings live in /etc/subfinder/enum.conf:

• TARGETS_FILE: the file the daily enumeration reads, one domain per line.
• SOURCE_TIMEOUT: the per-source timeout in seconds.
• MAX_TIME_MINUTES: the overall enumeration cap per domain.
• REPORT_RETENTION_DAYS: dated reports older than this are pruned.

After you edit the file, restart the timer:

sudo systemctl restart subfinder-enum.timer

Maintenance

• Scheduled enumeration: subfinder-enum.timer runs it daily. Run one on demand with sudo subfinder-enum-run, and inspect history with journalctl -u subfinder-enum.service.
• Upgrades: download a newer release from the Subfinder releases, verify it against the published checksums, and replace /usr/local/lib/subfinder/subfinder.
• Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.
• Stay passive: this image runs Subfinder in its default passive mode only. It never sends traffic to the domains you enumerate.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Subfinder on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com