loading
Loading content
loading
Scanners
Fast and customizable subdomain wordlist generator using patterns.
overview
alterx takes subdomains you already know and generates new candidate names by applying permutation patterns. Given names like api and dev, it produces variants such as api-dev, dev-api, and numbered or prefixed forms, expanding a small seed set into a wordlist tuned to the target's actual naming. That is more precise than a generic wordlist because the candidates are derived from real names in scope.
Patterns are fully customizable. You pass comma-separated permutation patterns or a pattern file, and the enrich option mines extra words from the input itself so the generated set reflects how the organization names things. An estimate mode reports how many permutations a configuration would produce before you commit to generating them, which matters when the count can explode.
On Trickest, alterx is a Scanners-category node that reads subdomains and a pattern config and writes a file and a folder of generated names. Place it between subdomain discovery and a DNS resolver: discovery finds the seed names, alterx multiplies them into candidates, and the resolver confirms which permutations resolve.
use cases
Feed discovered names into alterx to generate permutations tuned to the target's naming, then resolve them to find subdomains a passive pass never surfaced.
Turn on enrich so alterx extracts words from the seed names, producing candidates that match the organization's real naming conventions.
Use estimate mode to see how many permutations a pattern set would create, so you can tune patterns before a run blows the candidate count up.
Generate a target-specific candidate list with alterx and hand it to a resolver like puredns or shuffledns, so brute forcing tests names shaped by the target rather than a generic list.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | STRING | -list | Subdomains to use when creating permutations (comma-separated). |
| subdomains-file | FILE | -list | File of subdomains to use when creating permutations. |
| pattern | STRING | -pattern | Custom permutation patterns to generate (comma-separated). |
| enrich | BOOLEAN | -enrich | Enrich the wordlist by extracting words from the input. |
| limit | STRING | -limit | Limit the number of results to return (default 0). |
| estimate | BOOLEAN | -estimate | Estimate permutation count without generating payloads. |
| permutation-config | FILE | -ac | alterx permutation config file. |
Showing key inputs. alterx exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| limit | STRING | -limit | limit the number of results to return (default 0) |
| config | FILE | -config | alterx config file |
| enrich | BOOLEAN | -enrich | enrich wordlist by extracting words from input |
| silent | BOOLEAN | -silent | display results only |
| pattern | STRING | -pattern | custom permutation patterns input to generate (comma-separated) |
| verbose | BOOLEAN | -verbose | display verbose output |
| estimate | BOOLEAN | -estimate | estimate permutation count without generating payloads |
| max-size | STRING | -max-size | max export data size (kb, mb, gb, tb) (default mb) |
| subdomains | STRING | -list | subdomains to use when creating permutations (comma-separated) |
| pattern-list | FILE | -pattern | custom permutation patterns input to generate |
| subdomains-file | FILE | -list | subdomains to use when creating permutations |
| permutation-config | FILE | -ac | alterx permutation config file |
example
# expand known subdomains into a target-specific wordlistalterx -list subdomains.txt -pattern '{{word}}-{{sub}}.{{suffix}}' -enrich -o permutations.txtapi-dev.example.comdev-api.example.comstaging-api.example.comapi-staging.example.comapi1.example.comapi2.example.comadmin.dev.example.comdev.api.example.comapi-internal.example.com[INF] Generated 4230 permutations for 18 seed subdomainsguidance
Use alterx after subdomain discovery and before a DNS resolver, when you want to generate target-specific name candidates from known subdomains. It generates names, it does not resolve them, so follow it with a resolver such as dnsx, puredns, or shuffledns.
Generates subdomain permutations from a wordlist. alterx offers more configurable pattern control.
Permutation generator with depth and number options. A close alternative for altered-name generation.
Generates name variants from a list of domains. Pair any of these with a resolver to confirm hits.
faq
related
Find reflected XSS during recon by checking payload reflection.
Scans software bills of materials for security vulnerabilities.
Find broken links, missing images, and other dead references within your HTML.
A command-line scanner that finds exposed services, files, and folders through the web root.
A CMS detection and exploitation suite.
The Swiss Army knife for automated Web Application Testing.
Known subdomains feed alterx, which generates permutations and passes them to dnsx so only names that resolve land as output.
Facts on this page come from the live Trickest tool library.