> ## Documentation Index
> Fetch the complete documentation index at: https://trickest.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Enumerate Hostnames via Recursive DNS Brute Force
> Enumerate sub-subdomains of a list of hostnames using DNS brute force on the most likely hostnames
export const ModuleOverview = ({category, inputs, outputs, author, createdDate, iframeUrl, long_description}) =>
{category}
Created by
{author}
Last updated
{new Date(createdDate).toLocaleDateString()}
{long_description}
Input Parameters
{Object.entries(inputs).map(([key, value]) =>
{value.description}
)}
Outputs
{outputs.map((output, index) =>
{output}
)}
;
# Enumerate Hostnames via Recursive DNS Brute Force
## Description
Enumerate sub-subdomains of a list of hostnames using DNS brute force on the most likely hostnames. The module starts by determining which hostnames have the highest probability of having valid hostnames at other levels and then generates the permutations.
For example, given a subdomain like `test.foo.bar.baz.example.com`, it will try variations like `FUZZ.foo.bar.baz.example.com`, `FUZZ.bar.baz.example.com`, `FUZZ.baz.example.com`, and so on. It uses regularly updated wordlists made specifically for this purpose, based on analyzing the hostnames of hundreds of organizations. You can also use custom wordlists tailored to your organization’s naming conventions.
### Features
* Discovers **different environments, regions, and associated software** based on the input hostnames.
* **Faster than standard permutation scanning**, focusing on high-probability hostnames.
* **Built-in wordlists** with the option to **use custom ones** tailored to your target.
* A **daily validated list of resolvers** to ensure accuracy.
* Result **verification using manually curated trusted resolvers**.
* A **wildcard filter** takes care of false positives.
## Inputs
### Required
* **subdomains:** a list of subdomains
```
test.foo.bar.baz.example.com
dev.shop.example.com
```
### Optional
* **hostnames-per-level**l: the number of hostnames to brute-force at each level - a higher value will lead to more comprehensive results but also require more time and/or machines (default: 200)
* **level-2-wordlist**: a custom wordlist for level-2 enumeration `FUZZ.1.example.com`
```
prod
test
dev
```
* **level-3-wordlist**" a custom wordlist for level-3 enumeration `FUZZ.2.1.example.com`
```
api
web
ingress
```
* **level-4-wordlist**: a custom wordlist for level-4 (and higher) enumeration `FUZZ.3.2.1.example.com`
```
auth
admin
private
```
## Outputs
* **subdomains**: a list of found subdomains
```
prod.baz.example.com
api.dev.shop.example.com
admin.foo.bar.baz.example.com
```
* **subdomain-details**: JSONLines records of subdomain discovery details.
```json theme={null}
{"hostname": "prod.baz.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "recursive brute force"}
{"hostname": "api.dev.shop.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "recursive brute force"}
{"hostname": "admin.foo.bar.baz.example.com", "domain_name": "example.com", "data_source": "dns brute force", "context": "recursive brute force"}
```
## Changelog
* v1.0.0
* Initial release
* v1.0.1
* Improve wildcard filtering