Second DNS Brute-Force Round
After having found subdomains using open sources and brute-forcing, you could generate alterations of the subdomains found to try to find even more.
Last updated
After having found subdomains using open sources and brute-forcing, you could generate alterations of the subdomains found to try to find even more.
Last updated
Several tools are useful for this purpose:
Given the domains and subdomains generate permutations.
Given the domains and subdomains generate permutations.
Given the domains and subdomains generate permutations. If not permutations file is indicated gotator will use its own one.
Apart from generating subdomains permutations, it can also try to resolve them (but it's better to use the previous commented tools).
Another tool to perform permutations, mutations and alteration of subdomains. This tool will brute force the result (it doesn't support dns wild card).
Based on a domain it generates new potential subdomains names based on indicated patterns to try to discover more subdomains.
subzuf is a subdomain brute-force fuzzer coupled with an immensly simple but effective DNS reponse-guided algorithm. It utilizes a provided set of input data, like a tailored wordlist or historical DNS/TLS records, to accurately synthesize more corresponding domain names and expand them even further in a loop based on information gathered during DNS scan.
You can get altdns permutations wordlist in .
You can get dmut permutations wordlist in .
For more info read this but it will basically get the main parts from the discovered subdomains and will mix them to find more subdomains.