loading
Loading content
loading
Recon
Async DNS brute force for subdomains that passive sources miss.
overview
aiodnsbrute resolves every entry in a wordlist against a domain, keeping many lookups in flight with asyncio. Passive enumeration only surfaces names already in certificate logs or DNS aggregators. Brute force finds names that resolve in DNS but appear in no public source.
Point --wordlist at your subdomain list and raise --max-tasks for concurrency. Pass --resolver-file so a single upstream does not bottleneck the run. Wildcard detection is on by default; use --gethostbyname when you need CNAMEs for takeover triage.
The managed Recon node takes a domain and --wordlist and writes JSON to a file and folder. Run it beside a passive finder such as subfinder, then hand resolved names to httpx. It finds names; it does not probe them.
source github.com/blark/aiodnsbrute
use cases
Resolve a wordlist against a domain to find names that exist in DNS but are not published in certificate logs or aggregators, expanding the attack surface.
Supply a resolver file and raise max-tasks to push high concurrency through resolvers you trust, covering large wordlists quickly.
Use the gethostbyname mode to return CNAMEs, which highlights dangling records worth checking for takeover before an attacker does.
Hand the JSON output to httpx and a scanner so the workflow continues against subdomains that resolve, not the whole wordlist.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to brute force. |
| wordlist | FILE | --wordlist | Wordlist to use for the brute force. |
| resolvers-file | FILE | --resolver-file | File of DNS resolvers, one per line; defaults to system resolvers. |
| max-tasks | STRING | --max-tasks | Maximum number of tasks to run asynchronously. |
| wildcard | BOOLEAN | --wildcard | Wildcard detection, enabled by default. |
| get-host-by-name | BOOLEAN | --gethostbyname | Detect CNAMEs, handy for subdomain-takeover detection. |
| verbose | BOOLEAN | --verbosity | Increase output verbosity. |
Showing key inputs. aiodnsbrute exposes 11 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | · | Domain to brute force. |
| verbose | BOOLEAN | --verbosity | Increase output verbosity. |
| wildcard | BOOLEAN | --wildcard | Wildcard detection, enabled by default. |
| wordlist | FILE | --wordlist | Wordlist to use for the brute force. |
| max-tasks | STRING | --max-tasks | Maximum number of tasks to run asynchronously. |
| no-wildcard | BOOLEAN | --no-wildcard | Disable wildcard detection. |
| resolvers-file | FILE | --resolver-file | Text file of DNS resolvers, one per line, comments start with #. Defaults to the system resolvers. |
| dns-lookup-type | BOOLEAN | --query | Use DNS query lookups; faster, but does not return CNAME information. Enabled by default. |
| get-host-by-name | BOOLEAN | --gethostbyname | Detect CNAMEs, handy for potential subdomain-takeover detection. |
| verify-domain-name | BOOLEAN | --verify | Verify the domain name is sane before starting. Enabled by default. |
| dont-verify-domain-name | BOOLEAN | --no-verify | Skip the domain-name sanity check. |
example
# resolve a wordlist against example.com through custom resolvers at high concurrencyaiodnsbrute --wordlist /wordlists/dns-subdomains.txt --resolver-file resolvers.txt --max-tasks 1024 example.com[*] Brute forcing example.com with a maximum of 1024 concurrent tasks[*] Wildcard detection: no catch-all record found[+] www.example.com 198.51.100.24[+] api.example.com 198.51.100.51[+] mail.example.com 203.0.113.10[+] vpn.example.com 203.0.113.42[+] staging.example.com 198.51.100.77[*] Completed! 114441 names checked, 5 subdomains found in 88.20 secondsguidance
Use aiodnsbrute for active, wordlist-driven subdomain discovery alongside a passive finder like subfinder. Bring a solid wordlist and a --resolver-file. Follow with httpx; aiodnsbrute does not probe hosts.
massdns wrapper for fast resolution and brute forcing. Heavier setup, very high throughput.
Brute forces and resolves with wildcard filtering. Prefer when accuracy at scale is the priority.
Passive discovery only, no brute forcing. Run beside aiodnsbrute for combined coverage.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain and a wordlist feed aiodnsbrute, which resolves each candidate asynchronously and writes the discovered subdomains as a queryable output.
Facts on this page come from the live Trickest tool library.