Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 15, 2026

Scanners

Expand known subdomains into resolver candidates

Pattern-based subdomain wordlist generator from known names.

Agent
Expand known subdomains into a targeted wordlistEnrich permutations from the input itselfEstimate output size before generating

overview

What alterx does

Place alterx between subdomain discovery and a DNS resolver. Seeds arrive via -list; it writes a file and folder of candidates for dnsx, puredns, or shuffledns to confirm.

Reach for it when passive enum left a small set of real names and you want target-shaped guesses. Control generation with -pattern (or a pattern file), -enrich, and -ac. Use -estimate to preview count before a run; -limit caps results.

Unlike a generic subdomain wordlist, candidates derive from in-scope names. alterx does not resolve DNS, so wire its output into a resolver or you only get unverified strings. Trickest hosts it as a managed Scanners node.

source github.com/projectdiscovery/alterx

use cases

Where alterx fits

Expand known subdomains into a targeted wordlist

Feed discovered names into alterx to generate permutations tuned to the target's naming, then resolve them to find subdomains a passive pass never surfaced.

Enrich permutations from the input itself

Turn on enrich so alterx extracts words from the seed names, producing candidates that match the organization's real naming conventions.

Estimate output size before generating

Use estimate mode to see how many permutations a pattern set would create, so you can tune patterns before a run blows the candidate count up.

Drive a DNS brute-force pipeline

Generate a target-specific candidate list with alterx and hand it to a resolver like puredns or shuffledns, so brute forcing tests names shaped by the target rather than a generic list.

reference

alterx inputs and flags

12 inputs
NameTypeFlagDescription
subdomainsSTRING-listSubdomains to use when creating permutations (comma-separated).
subdomains-fileFILE-listFile of subdomains to use when creating permutations.
patternSTRING-patternCustom permutation patterns to generate (comma-separated).
enrichBOOLEAN-enrichEnrich the wordlist by extracting words from the input.
limitSTRING-limitLimit the number of results to return (default 0).
estimateBOOLEAN-estimateEstimate permutation count without generating payloads.
permutation-configFILE-acalterx permutation config file.

Showing key inputs. alterx exposes 12 inputs in total.

Full flag reference (12 inputs)
NameTypeFlagDescription
limitSTRING-limitlimit the number of results to return (default 0)
configFILE-configalterx config file
enrichBOOLEAN-enrichenrich wordlist by extracting words from input
silentBOOLEAN-silentdisplay results only
patternSTRING-patterncustom permutation patterns input to generate (comma-separated)
verboseBOOLEAN-verbosedisplay verbose output
estimateBOOLEAN-estimateestimate permutation count without generating payloads
max-sizeSTRING-max-sizemax export data size (kb, mb, gb, tb) (default mb)
subdomainsSTRING-listsubdomains to use when creating permutations (comma-separated)
pattern-listFILE-patterncustom permutation patterns input to generate
subdomains-fileFILE-listsubdomains to use when creating permutations
permutation-configFILE-acalterx permutation config file

example

Run alterx

alterx · command
# expand known subdomains into a target-specific wordlistalterx -list subdomains.txt -pattern '{{word}}-{{sub}}.{{suffix}}' -enrich -o permutations.txt
sample output
api-dev.example.comdev-api.example.comstaging-api.example.comapi-staging.example.comapi1.example.comapi2.example.comadmin.dev.example.comdev.api.example.comapi-internal.example.com[INF] Generated 4230 permutations for 18 seed subdomains

guidance

Choosing alterx

Use after subdomain discovery and before a DNS resolver, when you need target-specific name candidates from known subdomains. It generates names only. Follow with dnsx, puredns, or shuffledns. Prefer goaltdns, gotator, or dnsgen if you want a different permutation style.

goaltdns

Generates subdomain permutations from a wordlist. Prefer when you want simpler wordlist-driven alters; alterx adds a pattern DSL and -enrich.

gotator

Permutation generator with depth and number options. Close alternative when depth controls matter more than pattern templates.

dnsgen

Generates name variants from a domain list. Pair any of these with a resolver to confirm hits.

faq

alterx questions

No. alterx only emits candidate permutations. Pass its output to a DNS resolver such as dnsx or puredns to learn which names resolve.

related

More Scanners tools

  1. ac-scanner

    BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.

  2. airixss

    Reflection triage for parameter URLs during recon.

  3. bedrock-keys-security

    Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

  4. cmseek

    CMS detection and version fingerprinting.

  5. jaeles

    Signature-driven web application scanner.

  6. joomscan

    OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.

Run alterx yourself

Known subdomains feed alterx, which generates permutations and passes them to dnsx so only names that resolve land as output.

Open alterx in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.