loading
Loading content
loading
Attack Surface Management
Generate DNS permutations from hostnames you have. Alter labels for staging, regions, and related software, then resolve. Built-in wordlist or org naming.
Once you have a list of known hostnames, the next question is which related spellings also resolve. DNS permutation brute force alters the labels of hostnames you already have (dev, staging, region prefixes, related software names) and resolves the new spellings to find environment and region variants that passive OSINT and apex wordlists miss. The input is known hostnames, not root domains: dashboard.example.com in, dev-dashboard.example.com out.
You feed hostnames you already have. The module alters their labels for environments, regions, and related software, then resolves the new spellings. The input is known hosts, not apex domains.
Known hostnames from passive hostname OSINT and root-domain DNS brute force. Crawl can feed names back in after probe.
Found hostnames into probe for web servers and into recursive DNS brute force. Generate Custom DNS Wordlists derives lists for the brute-force siblings; this module does not consume those lists.
Recursive DNS brute force on the same seed, going deeper (new labels at other depths) rather than same-level alterations.
Nest this after a first hostname set exists. Enumerate Hostnames via OSINT Sources and Enumerate Hostnames via Root Domain DNS Brute Force produce the seed. Alter those known hosts here, then Enumerate Hostnames via Recursive DNS Brute Force for sub-subdomains, then Probe for Web Servers, then Enumerate Hostnames via Crawling. Do not feed apex domains into this face.
The tables this module produces. Sample rows are illustrative.
Resolved DNS permutations of known hostnames (altered labels for environments, regions, and related software).
hostnametext | domain_nametext | initial_assettext | initial_asset_typetext | discovery_methodtext | evidencetext | evidence_typetext | evidence_reproductiontext | |
|---|---|---|---|---|---|---|---|---|
| 1 | dev-dashboard.example.com | example.com | dashboard.example.com | hostname | dns permutation | A 203.0.113.10 resolved 2026-08-13 | dns answer | dig dev-dashboard.example.com +short |
| 2 | staging-api.example.com | example.com | api.example.com | hostname | dns permutation | A 203.0.113.20 resolved 2026-08-13 | dns answer | dig staging-api.example.com +short |
| 3 | eu-dashboard.example.com | example.com | dashboard.example.com | hostname | dns permutation | A 203.0.113.30 resolved 2026-08-13 | dns answer | dig eu-dashboard.example.com +short |
Artifact class it owns
Names third parties already know
Upstream it needs
domains
Artifact class it owns
Names in HTML, JS, headers of live sites
Upstream it needs
live URLs after probe
Enumerate Hostnames via DNS Permutations Brute Force
Artifact class it owns
Altered spellings of known hostnames
Upstream it needs
known hostnames
Artifact class it owns
First-level names against the apex
Upstream it needs
domains + wordlist
Artifact class it owns
Sub-subdomains of names you already have
Upstream it needs
known hostnames + level-2/3/4 wordlists
questions
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.