Recon
Expand known subdomains into live DNS hits
Permute known subdomains, then resolve what lives.
overview
What dmut does
dmut reads known subdomains on stdin and a mutation dictionary via -d, generates permutations and alterations, then resolves each candidate. Output is the live names only, optionally with --show-ip.
Run it after passive discovery like subfinder when hosts follow naming patterns: a known dev host often implies dev1, dev2, or dev-staging that certificate logs never returned.
dnsgen and gotator stop at generation, so you pipe into a separate resolver. dmut generates and validates DNS in one pass with --workers, --dns-retries, and --dnsServers or -s. Hand resolved hosts to httpx next.
source github.com/bp0lr/dmut
use cases
Where dmut fits
Expand a known subdomain set
Feed dmut the output of passive discovery and a mutation dictionary to generate and resolve permutations that certificate logs and DNS aggregators never returned.
Brute-force generated names in one pass
Use the built-in worker pool and resolver list to resolve every generated candidate directly, so permutation and DNS validation happen inside a single node.
Keep resolution accurate at scale
Tune --workers, --dns-retries, --dns-timeout, and --dns-errorLimit, and refresh the public resolver list, so a large job stays accurate instead of drowning in failed queries.
Feed live hosts to a probing pipeline
Pass dmut's resolved names to httpx to learn which mutated hosts respond over HTTP, then carry the live surface into the rest of the workflow.
reference
dmut inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | · | Subdomains to generate permutations for (piped in on stdin). |
| dictionary | FILE | -d | Dictionary file containing the mutation list. |
| dns-servers-file | FILE | -s | Resolve using DNS servers from this file. |
| dns-servers-list | STRING | --dnsServers | Resolve using DNS servers from a comma-separated list. |
| workers | STRING | --workers | Number of concurrent workers (default 25). |
| dns-retries | STRING | --dns-retries | Max retries for failed DNS queries (default 3). |
| update-dns-list | BOOLEAN | --update-dnslist | Download a fresh list of validated public DNS resolvers. |
| show-ip | BOOLEAN | --show-ip | Display the resolved IP for valid results. |
Showing key inputs. dmut exposes 13 inputs in total.
Full flag reference (13 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| show-ip | BOOLEAN | --show-ip | Display extra info, including the resolved IP, for valid results. |
| verbose | BOOLEAN | --verbose | Add verbosity to the process. |
| workers | STRING | --workers | Number of concurrent workers (default 25). |
| dictionary | FILE | -d | Dictionary file containing the mutation list. |
| show-stats | BOOLEAN | --show-stats | Display stats about the current job. |
| subdomains | FILE | · | Subdomains to generate permutations for, read on stdin. |
| target-url | STRING | --url | Single target to generate permutations for. |
| dns-retries | STRING | --dns-retries | Max retries for failed DNS queries (default 3). |
| dns-timeout | STRING | --dns-timeout | DNS server timeout in milliseconds (default 500). |
| dns-error-limit | STRING | --dns-errorLimit | Number of errors before a DNS server is disabled (default 25). |
| update-dns-list | BOOLEAN | --update-dnslist | Download a list of periodically validated public DNS resolvers. |
| dns-servers-file | FILE | -s | Use DNS servers from this file. |
| dns-servers-list | STRING | --dnsServers | Use DNS servers from a comma-separated list. |
example
Run dmut
# mutate a known subdomain list and resolve the live candidatescat known-subdomains.txt | dmut -d mutations.txt --workers 100 --dns-retries 5 --show-ip --update-dnslist -o resolved.txtdev2.example.com [198.51.100.24]dev-staging.example.com [198.51.100.25]api-uat.example.com [198.51.100.61]api-dev.example.com [203.0.113.12]admin-staging.example.com [203.0.113.48]vpn2.example.com [198.51.100.90]grafana-dev.example.com [203.0.113.77]… (41 of 9,120 permutations resolved in the run behind this page)guidance
Choosing dmut
Use dmut after passive discovery to mutate known subdomains and resolve the permutations in one step. For generating permutations without resolving them, use dnsgen or gotator and pass the candidates to a resolver. dmut finds names; follow it with httpx to see which respond over HTTP.
dnsgen
Generates permutations only. dmut also resolves the candidates in the same run.
gotator
Permutation generator with flexible rules. Pair it with a resolver; dmut bundles resolution.
goaltdns
Another alteration-based generator. dmut combines mutation and brute-force validation.
faq
dmut questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run dmut yourself
A known subdomain list and a mutation dictionary feed dmut, which generates permutations, resolves them, and writes the live names as output.
Facts on this page come from the live Trickest tool library.