Why not just run permutations?

Permutations need a seed of known hostnames. This builds that seed by wordlisting the apex. Run this or OSINT first, then alter the names that come back.

Should I bring a custom wordlist?

Yes when you know the target's naming. Otherwise the built-in list runs. Derive an org-specific `level-1-wordlist` with [Generate Custom DNS Wordlists](/library/modules/generate-custom-dns-wordlists) from prior results.

What order do I run the family in?

OSINT and this first (both take domains), then permutations and recursive on the known hostnames that come back, then probe, then crawl once something speaks HTTP. The wordlist feeder sits beside this and the recursive module.

Can I feed known hostnames into `domains`?

No. This face expects apex / root names. Known hostnames belong on recursive DNS brute force or on DNS permutations.

2026-08-13

Attack Surface Management

Enumerate Hostnames via Root Domain DNS Brute Force

Wordlist DNS brute force against root domains. Finds first-level names OSINT missed. Input is domains plus an optional custom wordlist, not known hostnames.

What Enumerate Hostnames via Root Domain DNS Brute Force does

DNS brute force against the apex is how you find unpublished first-level subdomains. Given a list of root domains, the module resolves first-level hostname candidates (label.example.com) against a wordlist to surface names that passive OSINT never recorded, then feeds those names into permutations and recursive brute force for deeper coverage. A built-in wordlist runs by default; pin a custom one when you know the target's naming conventions.

You feed apex domains. The module wordlists first-level names against those apexes (label.example.com) and resolves them. A built-in list runs unless you pin a custom wordlist. This is first-level vs the apex, not sub-subdomains of names you already have. You nest this subgraph on a domain list; you do not run it from a shell.

Where it fits in the pipeline

Illustrative excerpt. Each node is a Trickest module.

Upstream

A domain list from scope, an asset inventory, or extra roots you accepted from passive hostname OSINT.

Downstream

First-level subdomains into DNS permutations and recursive DNS brute force as known-hostname seeds, then probe for web servers. Generate custom DNS wordlists can derive a level-1-wordlist from names you already have and feed it back here as wordlist.

Parallel

Passive hostname OSINT on the same domains. That reads recorded names. This wordlists unpublished first-level labels.

When to use this

Nest this beside Enumerate Hostnames via OSINT Sources on a domain list, after you have apexes and before you have a hostname seed. OSINT reads what third parties already recorded. This wordlists unpublished first-level labels. Then Enumerate Hostnames via DNS Permutations Brute Force and Enumerate Hostnames via Recursive DNS Brute Force on the names that come back. Probe for Web Servers next. Enumerate Hostnames via Crawling last, only on live URLs.

Data

The tables this module produces. Sample rows are illustrative.

hostnames8 columns · 3 sample rows

First-level hostnames resolved against the apex domains via DNS wordlist brute force.

	hostnametext	domain_nametext	initial_assettext	initial_asset_typetext	discovery_methodtext	evidencetext	evidence_typetext	evidence_reproductiontext
1	vpn.example.com	example.com	example.com	domain	dns brute force	A 203.0.113.51 resolved 2026-08-13	dns answer	dig vpn.example.com +short
2	staging.example.com	example.com	example.com	domain	dns brute force	A 203.0.113.52 resolved 2026-08-13	dns answer	dig staging.example.com +short
3	mail.example.com	example.com	example.com	domain	dns brute force	A 203.0.113.53 resolved 2026-08-13	dns answer	dig mail.example.com +short

How it differs from similar modules

Passive hostname OSINT

Artifact class it owns

Names third parties already know

Upstream it needs

domains

Hostname crawl

Artifact class it owns

Names in HTML, JS, headers of live sites

Upstream it needs

live URLs after probe

DNS permutations

Artifact class it owns

Altered spellings of known hostnames

Upstream it needs

known hostnames

Enumerate Hostnames via Root Domain DNS Brute Force

Artifact class it owns

First-level names against the apex

Upstream it needs

domains + wordlist

Recursive DNS brute force

Artifact class it owns

Sub-subdomains of names you already have

Upstream it needs

known hostnames + level-2/3/4 wordlists

questions

Enumerate Hostnames via Root Domain DNS Brute Force questions

This wordlists first-level names against the apex (`label.example.com`). Recursive brute-forces new labels at other depths of names you already have (`FUZZ.foo.bar.example.com`). Different input (domains vs known hostnames), different depth, different output shape. Run this or OSINT first to build the seed, then recurse.

Related modules

Nest Enumerate Hostnames via Root Domain DNS Brute Force in a workflow

Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.

Build with Enumerate Hostnames via Root Domain DNS Brute Force Browse modules

Get a personalized demo

See Trickest in Action

A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.

Book a demo Explore the platform