loading
Loading content
loading
Network
Maximize your resolver count by combining the target's DNS servers with public resolvers.
overview
bass targets a quiet bottleneck in DNS brute forcing: the resolver list. A mass-DNS tool is only as fast as the pool of healthy resolvers it can spread queries across, and a small or stale list throttles the whole run. bass widens that pool for each target you point it at.
It reads the DNS servers the target's own domain relies on, keeps the valid ones, and merges them with your starting set of public resolvers. The output is the largest reliable resolver list you can assemble for that specific domain, which lets a downstream resolver push far more queries in parallel.
Reach for bass right before the heavy enumeration step. Feed a root domain in, take the resolver file out, and wire it into the resolvers input of massdns, puredns, or shuffledns so the brute-force pass runs against a bigger, target-tuned pool.
use cases
Build a larger resolver set for the target so a downstream resolver spreads queries wider and finishes a big wordlist faster.
Fold the target's valid DNS servers into the pool so resolution leans on infrastructure close to the names being queried.
Combine your public resolvers with freshly validated ones for the target, replacing a list that has gone slow or unreliable.
Generate the resolver list first, then feed it to a brute-force resolver and a prober so the whole pipeline runs at full throughput.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target-root-domain | STRING | -d | Target root domain to build the resolver set for. |
Showing key inputs. bass exposes 1 inputs in total.
example
# build a target-tuned resolver list, then reuse it with a mass-DNS resolverbass -d example.com -o resolvers.txt198.51.100.14198.51.100.53203.0.113.7203.0.113.42198.51.100.111203.0.113.150198.51.100.201203.0.113.98… (1,284 resolvers written: public.txt merged with the target's own valid DNS servers)guidance
Use bass to assemble the biggest reliable resolver list for a target before heavy DNS brute forcing. It builds resolvers, it does not enumerate names, so feed its list into massdns, puredns, or shuffledns next.
Validates public resolvers for reliability. bass goes further by mixing in the target's own DNS servers.
Mass resolver and subdomain brute forcer. Consumes the resolver list bass produces.
High-performance DNS resolver. Runs faster with the larger resolver pool bass assembles.
faq
related
Quickly map an organization's network ranges using ASN information.
Expand CIDR ranges into a list of IP addresses easily.
Expand CIDR ranges into a list of IP addresses easily, from a file.
Maintain a list of IPv4 DNS servers verified against baseline servers for accurate responses.
Patched dnsvalidator that keeps only IPv4 resolvers verified against baseline servers.
A simple Node.js network scanner.
A root domain feeds bass, which builds a target-tuned resolver list and hands it to puredns so the brute-force resolution runs at full speed and writes subdomains.
Facts on this page come from the live Trickest tool library.