Recon
Resolve wordlist subdomains a passive pass missed
Async DNS brute force for subdomains that passive sources miss.
overview
What aiodnsbrute does
aiodnsbrute resolves every entry in a wordlist against a domain, keeping many lookups in flight with asyncio. Passive enumeration only surfaces names already in certificate logs or DNS aggregators. Brute force finds names that resolve in DNS but appear in no public source.
Point --wordlist at your subdomain list and raise --max-tasks for concurrency. Pass --resolver-file so a single upstream does not bottleneck the run. Wildcard detection is on by default; use --gethostbyname when you need CNAMEs for takeover triage.
The managed Recon node takes a domain and --wordlist and writes JSON to a file and folder. Run it beside a passive finder such as subfinder, then hand resolved names to httpx. It finds names; it does not probe them.
source github.com/blark/aiodnsbrute
use cases
Where aiodnsbrute fits
Brute force subdomains a passive pass missed
Resolve a wordlist against a domain to find names that exist in DNS but are not published in certificate logs or aggregators, expanding the attack surface.
Run fast enumeration with custom resolvers
Supply a resolver file and raise max-tasks to push high concurrency through resolvers you trust, covering large wordlists quickly.
Spot subdomain-takeover candidates
Use the gethostbyname mode to return CNAMEs, which highlights dangling records worth checking for takeover before an attacker does.
Feed resolved names into a probing pipeline
Hand the JSON output to httpx and a scanner so the workflow continues against subdomains that resolve, not the whole wordlist.
reference
aiodnsbrute inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to brute force. |
| wordlist | FILE | --wordlist | Wordlist to use for the brute force. |
| resolvers-file | FILE | --resolver-file | File of DNS resolvers, one per line; defaults to system resolvers. |
| max-tasks | STRING | --max-tasks | Maximum number of tasks to run asynchronously. |
| wildcard | BOOLEAN | --wildcard | Wildcard detection, enabled by default. |
| get-host-by-name | BOOLEAN | --gethostbyname | Detect CNAMEs, handy for subdomain-takeover detection. |
| verbose | BOOLEAN | --verbosity | Increase output verbosity. |
Showing key inputs. aiodnsbrute exposes 11 inputs in total.
Full flag reference (11 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to brute force. |
| verbose | BOOLEAN | --verbosity | Increase output verbosity. |
| wildcard | BOOLEAN | --wildcard | Wildcard detection, enabled by default. |
| wordlist | FILE | --wordlist | Wordlist to use for the brute force. |
| max-tasks | STRING | --max-tasks | Maximum number of tasks to run asynchronously. |
| no-wildcard | BOOLEAN | --no-wildcard | Disable wildcard detection. |
| resolvers-file | FILE | --resolver-file | Text file of DNS resolvers, one per line, comments start with #. Defaults to the system resolvers. |
| dns-lookup-type | BOOLEAN | --query | Use DNS query lookups; faster, but does not return CNAME information. Enabled by default. |
| get-host-by-name | BOOLEAN | --gethostbyname | Detect CNAMEs, handy for potential subdomain-takeover detection. |
| verify-domain-name | BOOLEAN | --verify | Verify the domain name is sane before starting. Enabled by default. |
| dont-verify-domain-name | BOOLEAN | --no-verify | Skip the domain-name sanity check. |
example
Run aiodnsbrute
# resolve a wordlist against example.com through custom resolvers at high concurrencyaiodnsbrute --wordlist /wordlists/dns-subdomains.txt --resolver-file resolvers.txt --max-tasks 1024 example.com[*] Brute forcing example.com with a maximum of 1024 concurrent tasks[*] Wildcard detection: no catch-all record found[+] www.example.com 198.51.100.24[+] api.example.com 198.51.100.51[+] mail.example.com 203.0.113.10[+] vpn.example.com 203.0.113.42[+] staging.example.com 198.51.100.77[*] Completed! 114441 names checked, 5 subdomains found in 88.20 secondsguidance
Choosing aiodnsbrute
Use aiodnsbrute for active, wordlist-driven subdomain discovery alongside a passive finder like subfinder. Bring a solid wordlist and a --resolver-file. Follow with httpx; aiodnsbrute does not probe hosts.
shuffledns
massdns wrapper for fast resolution and brute forcing. Heavier setup, very high throughput.
puredns
Brute forces and resolves with wildcard filtering. Prefer when accuracy at scale is the priority.
subfinder
Passive discovery only, no brute forcing. Run beside aiodnsbrute for combined coverage.
faq
aiodnsbrute questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run aiodnsbrute yourself
A domain and a wordlist feed aiodnsbrute, which resolves each candidate asynchronously and writes the discovered subdomains as a queryable output.
Facts on this page come from the live Trickest tool library.