Brute force a domain's subdomains from a wordlist

aiodnsbrute brute forces subdomains by resolving every entry in a wordlist against a domain, running the lookups concurrently with Python asyncio so thousands of queries stay in flight at once. Where passive enumeration only surfaces names already published in certificate logs or DNS aggregators, brute forcing finds names that resolve in DNS but appear in no public source, which is how it fills the gaps a passive pass leaves.

The tool is built for throughput. You cap concurrency with a max-tasks limit and point it at your own resolver file so a single upstream does not bottleneck the run. Wildcard detection runs by default so a catch-all record does not flood the results with false positives, and the gethostbyname mode surfaces CNAMEs worth checking for subdomain takeover.

On Trickest, aiodnsbrute is a Recon node that takes a domain and a wordlist and writes its results as JSON in a file and a folder. Run it alongside a passive finder for fuller coverage, then pass the resolved names to a prober so the rest of the workflow only touches hosts that answer.