> For the complete documentation index, see [llms.txt](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pcastagnaro.gitbook.io/pentest-bug-bounty-resources/pentest-bounty-resources/networking/domains-and-subdomains/dns-brute-force/second-dns-brute-force-round.md).

# Second DNS Brute-Force Round

After having found subdomains using open sources and brute-forcing, you could generate alterations of the subdomains found to try to find even more.

Several tools are useful for this purpose:

## [**dnsgen**](https://github.com/ProjectAnte/dnsgen)

Given the domains and subdomains generate permutations.

{% code overflow="wrap" lineNumbers="true" %}

```bash
cat subdomains.txt | dnsgen -
```

{% endcode %}

***

## [**goaltdns**](https://github.com/subfinder/goaltdns)

Given the domains and subdomains generate permutations.

{% hint style="info" %}
You can get goaltdns permutations **wordlist** in [**here**](https://github.com/subfinder/goaltdns/blob/master/words.txt).
{% endhint %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
goaltdns -l subdomains.txt -w /tmp/words-permutations.txt -o /tmp/final-words-s3.txt
```

{% endcode %}

***

## [**gotator**](https://github.com/Josue87/gotator)

Given the domains and subdomains generate permutations. If not permutations file is indicated gotator will use its own one.

{% code overflow="wrap" lineNumbers="true" %}

```bash
gotator -sub subdomains.txt -silent [-perm /tmp/words-permutations.txt]
```

{% endcode %}

***

## [**altdns**](https://github.com/infosec-au/altdns)

Apart from generating subdomains permutations, it can also try to resolve them (but it's better to use the previous commented tools).

{% hint style="info" %}
You can get altdns permutations **wordlist** in [**here**](https://github.com/infosec-au/altdns/blob/master/words.txt).
{% endhint %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
altdns -i subdomains.txt -w /tmp/words-permutations.txt -o /tmp/asd3
```

{% endcode %}

***

## [**dmut**](https://github.com/bp0lr/dmut)

Another tool to perform permutations, mutations and alteration of subdomains. This tool will brute force the result (it doesn't support dns wild card).

{% hint style="info" %}
You can get dmut permutations wordlist in [**here**](https://raw.githubusercontent.com/bp0lr/dmut/main/words.txt).
{% endhint %}

{% code overflow="wrap" lineNumbers="true" %}

```bash
cat subdomains.txt | dmut -d /tmp/words-permutations.txt -w 100 --dns-errorLimit 10 --use-pb --verbose -s /tmp/resolvers-trusted.txt
```

{% endcode %}

***

## [**alterx**](https://github.com/projectdiscovery/alterx)

Based on a domain it **generates new potential subdomains names** based on indicated patterns to try to discover more subdomains.

### **Smart permutations generation**

#### [**regulator**](https://github.com/cramppet/regulator)

For more info read this [**post**](https://cramppet.github.io/regulator/index.html) but it will basically get the **main parts** from the **discovered subdomains** and will mix them to find more subdomains.

{% code overflow="wrap" lineNumbers="true" %}

```bash
python3 main.py adobe.com adobe adobe.rules
make_brute_list.sh adobe.rules adobe.brute
puredns resolve adobe.brute --write adobe.valid
```

{% endcode %}

***

#### [**subzuf**](https://github.com/elceef/subzuf)

*subzuf* is a subdomain brute-force fuzzer coupled with an immensly simple but effective DNS reponse-guided algorithm. It utilizes a provided set of input data, like a tailored wordlist or historical DNS/TLS records, to accurately synthesize more corresponding domain names and expand them even further in a loop based on information gathered during DNS scan.

{% code overflow="wrap" lineNumbers="true" %}

```bash
echo www | subzuf facebook.com
```

{% endcode %}