loading
Loading content
loading
Recon
Permute known subdomains, then resolve what lives.
overview
dmut reads known subdomains on stdin and a mutation dictionary via -d, generates permutations and alterations, then resolves each candidate. Output is the live names only, optionally with --show-ip.
Run it after passive discovery like subfinder when hosts follow naming patterns: a known dev host often implies dev1, dev2, or dev-staging that certificate logs never returned.
dnsgen and gotator stop at generation, so you pipe into a separate resolver. dmut generates and validates DNS in one pass with --workers, --dns-retries, and --dnsServers or -s. Hand resolved hosts to httpx next.
source github.com/bp0lr/dmut
use cases
Feed dmut the output of passive discovery and a mutation dictionary to generate and resolve permutations that certificate logs and DNS aggregators never returned.
Use the built-in worker pool and resolver list to resolve every generated candidate directly, so permutation and DNS validation happen inside a single node.
Tune --workers, --dns-retries, --dns-timeout, and --dns-errorLimit, and refresh the public resolver list, so a large job stays accurate instead of drowning in failed queries.
Pass dmut's resolved names to httpx to learn which mutated hosts respond over HTTP, then carry the live surface into the rest of the workflow.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | · | Subdomains to generate permutations for (piped in on stdin). |
| dictionary | FILE | -d | Dictionary file containing the mutation list. |
| dns-servers-file | FILE | -s | Resolve using DNS servers from this file. |
| dns-servers-list | STRING | --dnsServers | Resolve using DNS servers from a comma-separated list. |
| workers | STRING | --workers | Number of concurrent workers (default 25). |
| dns-retries | STRING | --dns-retries | Max retries for failed DNS queries (default 3). |
| update-dns-list | BOOLEAN | --update-dnslist | Download a fresh list of validated public DNS resolvers. |
| show-ip | BOOLEAN | --show-ip | Display the resolved IP for valid results. |
Showing key inputs. dmut exposes 13 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| show-ip | BOOLEAN | --show-ip | Display extra info, including the resolved IP, for valid results. |
| verbose | BOOLEAN | --verbose | Add verbosity to the process. |
| workers | STRING | --workers | Number of concurrent workers (default 25). |
| dictionary | FILE | -d | Dictionary file containing the mutation list. |
| show-stats | BOOLEAN | --show-stats | Display stats about the current job. |
| subdomains | FILE | · | Subdomains to generate permutations for, read on stdin. |
| target-url | STRING | --url | Single target to generate permutations for. |
| dns-retries | STRING | --dns-retries | Max retries for failed DNS queries (default 3). |
| dns-timeout | STRING | --dns-timeout | DNS server timeout in milliseconds (default 500). |
| dns-error-limit | STRING | --dns-errorLimit | Number of errors before a DNS server is disabled (default 25). |
| update-dns-list | BOOLEAN | --update-dnslist | Download a list of periodically validated public DNS resolvers. |
| dns-servers-file | FILE | -s | Use DNS servers from this file. |
| dns-servers-list | STRING | --dnsServers | Use DNS servers from a comma-separated list. |
example
# mutate a known subdomain list and resolve the live candidatescat known-subdomains.txt | dmut -d mutations.txt --workers 100 --dns-retries 5 --show-ip --update-dnslist -o resolved.txtdev2.example.com [198.51.100.24]dev-staging.example.com [198.51.100.25]api-uat.example.com [198.51.100.61]api-dev.example.com [203.0.113.12]admin-staging.example.com [203.0.113.48]vpn2.example.com [198.51.100.90]grafana-dev.example.com [203.0.113.77]… (41 of 9,120 permutations resolved in the run behind this page)guidance
Use dmut after passive discovery to mutate known subdomains and resolve the permutations in one step. For generating permutations without resolving them, use dnsgen or gotator and pass the candidates to a resolver. dmut finds names; follow it with httpx to see which respond over HTTP.
Generates permutations only. dmut also resolves the candidates in the same run.
Permutation generator with flexible rules. Pair it with a resolver; dmut bundles resolution.
Another alteration-based generator. dmut combines mutation and brute-force validation.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A known subdomain list and a mutation dictionary feed dmut, which generates permutations, resolves them, and writes the live names as output.
Facts on this page come from the live Trickest tool library.