Network
Assemble a target-tuned resolver pool before mass DNS
Merge the target's DNS servers with public resolvers into one pool.
overview
What bass does
bass sits ahead of mass-DNS brute forcing. It widens the resolver pool a target will be queried through, so massdns, puredns, or shuffledns can spread work across more healthy endpoints.
Reach for it when your public resolver list is thin or stale for a given domain. A small pool throttles the whole enumeration run.
Pass the root domain with -d. bass validates the target's own DNS servers, merges them with your public set, and writes a FILE plus FOLDER of resolver IPs for the next node.
use cases
Where bass fits
Speed up mass DNS brute forcing
Build a larger resolver set for the target so a downstream resolver spreads queries wider and finishes a big wordlist faster.
Tune resolvers to the target's own DNS
Fold the target's valid DNS servers into the pool so resolution leans on infrastructure close to the names being queried.
Refresh a stale public resolver list
Combine your public resolvers with freshly validated ones for the target, replacing a list that has gone slow or unreliable.
Prep a subdomain enumeration workflow
Generate the resolver list first, then feed it to a brute-force resolver and a prober so the whole pipeline runs at full throughput.
reference
bass inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| target-root-domain | STRING | -d | Target root domain to build the resolver set for. |
Showing key inputs. bass exposes 1 inputs in total.
example
Run bass
# build a target-tuned resolver list, then reuse it with a mass-DNS resolverbass -d example.com -o resolvers.txt198.51.100.14198.51.100.53203.0.113.7203.0.113.42198.51.100.111203.0.113.150198.51.100.201203.0.113.98… (1,284 resolvers written: public.txt merged with the target's own valid DNS servers)guidance
Choosing bass
Use bass to assemble the largest reliable resolver list for a target before heavy DNS brute forcing. It builds resolvers; it does not enumerate names. Feed its list into massdns, puredns, or shuffledns next.
dnsvalidator
Validates public resolvers for reliability. bass also folds in the target's own DNS servers.
puredns
Mass resolver and subdomain brute forcer. Consumes the resolver list bass produces.
massdns
High-performance DNS resolver. Runs against the larger pool bass assembles.
faq
bass questions
related
More Network tools
asnmap
Map an organization's network ranges from ASN data.
dnsvalidator
Validate public DNS resolvers against trusted baselines.
fping
Parallel ICMP echo sweeps for CIDR ranges and host files.
httprobe
Probe a domain list for working HTTP and HTTPS servers.
httpx
A fast and multi-purpose HTTP toolkit that runs multiple probers with reliable, high-throughput results.
mapcidr
Expand, aggregate, and slice CIDR ranges into host lists.
Run bass yourself
A root domain feeds bass, which builds a target-tuned resolver list and hands it to puredns so the brute-force resolution runs at full speed and writes subdomains.
Facts on this page come from the live Trickest tool library.