loading
Loading content
loading
Scanners
Pattern-based subdomain wordlist generator from known names.
overview
Place alterx between subdomain discovery and a DNS resolver. Seeds arrive via -list; it writes a file and folder of candidates for dnsx, puredns, or shuffledns to confirm.
Reach for it when passive enum left a small set of real names and you want target-shaped guesses. Control generation with -pattern (or a pattern file), -enrich, and -ac. Use -estimate to preview count before a run; -limit caps results.
Unlike a generic subdomain wordlist, candidates derive from in-scope names. alterx does not resolve DNS, so wire its output into a resolver or you only get unverified strings. Trickest hosts it as a managed Scanners node.
use cases
Feed discovered names into alterx to generate permutations tuned to the target's naming, then resolve them to find subdomains a passive pass never surfaced.
Turn on enrich so alterx extracts words from the seed names, producing candidates that match the organization's real naming conventions.
Use estimate mode to see how many permutations a pattern set would create, so you can tune patterns before a run blows the candidate count up.
Generate a target-specific candidate list with alterx and hand it to a resolver like puredns or shuffledns, so brute forcing tests names shaped by the target rather than a generic list.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | STRING | -list | Subdomains to use when creating permutations (comma-separated). |
| subdomains-file | FILE | -list | File of subdomains to use when creating permutations. |
| pattern | STRING | -pattern | Custom permutation patterns to generate (comma-separated). |
| enrich | BOOLEAN | -enrich | Enrich the wordlist by extracting words from the input. |
| limit | STRING | -limit | Limit the number of results to return (default 0). |
| estimate | BOOLEAN | -estimate | Estimate permutation count without generating payloads. |
| permutation-config | FILE | -ac | alterx permutation config file. |
Showing key inputs. alterx exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | -limit | limit the number of results to return (default 0) |
| config | FILE | -config | alterx config file |
| enrich | BOOLEAN | -enrich | enrich wordlist by extracting words from input |
| silent | BOOLEAN | -silent | display results only |
| pattern | STRING | -pattern | custom permutation patterns input to generate (comma-separated) |
| verbose | BOOLEAN | -verbose | display verbose output |
| estimate | BOOLEAN | -estimate | estimate permutation count without generating payloads |
| max-size | STRING | -max-size | max export data size (kb, mb, gb, tb) (default mb) |
| subdomains | STRING | -list | subdomains to use when creating permutations (comma-separated) |
| pattern-list | FILE | -pattern | custom permutation patterns input to generate |
| subdomains-file | FILE | -list | subdomains to use when creating permutations |
| permutation-config | FILE | -ac | alterx permutation config file |
example
# expand known subdomains into a target-specific wordlistalterx -list subdomains.txt -pattern '{{word}}-{{sub}}.{{suffix}}' -enrich -o permutations.txtapi-dev.example.comdev-api.example.comstaging-api.example.comapi-staging.example.comapi1.example.comapi2.example.comadmin.dev.example.comdev.api.example.comapi-internal.example.com[INF] Generated 4230 permutations for 18 seed subdomainsguidance
Use after subdomain discovery and before a DNS resolver, when you need target-specific name candidates from known subdomains. It generates names only. Follow with dnsx, puredns, or shuffledns. Prefer goaltdns, gotator, or dnsgen if you want a different permutation style.
Generates subdomain permutations from a wordlist. Prefer when you want simpler wordlist-driven alters; alterx adds a pattern DSL and -enrich.
Permutation generator with depth and number options. Close alternative when depth controls matter more than pattern templates.
Generates name variants from a domain list. Pair any of these with a resolver to confirm hits.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
Known subdomains feed alterx, which generates permutations and passes them to dnsx so only names that resolve land as output.
Facts on this page come from the live Trickest tool library.