loading
Loading content
loading
Attack Surface Management
Derive DNS brute-force wordlists from known hostnames. Root-class and recursive level lists for the hostname enum modules. Does not resolve names.
DNS wordlist generation turns the hostnames you already know into the wordlists the next brute-force pass needs. Subdomain enumeration plateaus when a generic list stops matching the target's naming conventions; this module derives org-specific lists from the keywords and dotted labels already in your seed, so a second pass hits names a public list would miss. It does not resolve names, does not enumerate, and is not a sixth hostname enumerator. You nest it between a seed set and a second brute-force pass; you do not run it from a shell.
You feed known hostnames. The module derives org-specific DNS wordlists from the keywords and naming already in those names. It does not resolve, does not enumerate, and is not a sixth hostname enumerator. You nest this feeder between a seed set and a second brute-force pass; you do not run it from a shell.
Known hostnames from any of the five enumerators.
level-1-wordlist into Enumerate Hostnames via Root Domain DNS Brute Force as wordlist. level-2-wordlist, level-3-wordlist, and level-4-wordlist into Enumerate Hostnames via Recursive DNS Brute Force.
DNS permutations on the same seed. That alters FQDNs and resolves them. This emits lists and resolves nothing.
Nest this after a seed hostname set exists, before a second brute-force pass. Skip it when you only have apex names or when the built-in lists are enough. Any of the five hostname enumerators can produce the seed: Enumerate Hostnames via OSINT Sources, Enumerate Hostnames via Crawling, Enumerate Hostnames via DNS Permutations Brute Force, Enumerate Hostnames via Root Domain DNS Brute Force, and Enumerate Hostnames via Recursive DNS Brute Force.
The tables this module produces. Sample rows are illustrative.
Root-class wordlist: tokens and dotted combinations from the input hostnames. Consumed by root-domain DNS brute force.
wordtext | |
|---|---|
| 1 | api |
| 2 | staging |
| 3 | dev |
Recursive-class wordlist for second-level subdomain brute force.
wordtext | |
|---|---|
| 1 | internal |
| 2 | portal |
| 3 | vpn |
Recursive-class wordlist for third-level subdomain brute force.
wordtext | |
|---|---|
| 1 | auth |
| 2 | cache |
| 3 | proxy |
Recursive-class wordlist for fourth-level subdomain brute force.
wordtext | |
|---|---|
| 1 | edge |
| 2 | node |
| 3 | relay |
questions
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.