Enumerate Hostnames via Recursive DNS Brute Force

Sub-subdomain enumeration walks the label tree of a known hostname. Given a deep name like test.foo.bar.baz.example.com, recursive DNS brute force tries FUZZ at each shorter suffix to find new labels at other depths, which is a different move from same-level permutations or first-level wordlists against the apex. The module ranks which hostnames are most likely to have valid names at other levels, then generates and resolves candidates with built-in or custom per-level wordlists.

You feed known hostnames. The module ranks which of those names are likely to have valid labels at other depths, then brute-forces new labels there (FUZZ.foo.bar.example.com, FUZZ.bar.example.com). This is sub-subdomains of names you already have, not first-level vs the apex. You nest this subgraph on a hostname list; you do not run it from a shell.