Mutate known subdomains and brute-force live hosts

dmut takes a list of subdomains you already know and generates permutations, mutations, and alterations of them, then resolves each candidate to keep only the names that exist. Hosts get named in patterns, so dev1, dev2, and dev-staging tend to live next to a dev host you already found.

It handles generation and DNS validation in one pass. A pool of workers resolves candidates in parallel against a list of public resolvers, with retry, timeout, and error-limit controls plus an option to refresh the resolver list, so a large permutation set collapses into a clean set of live hosts without a separate massdns step.

On Trickest, dmut is a Recon node that reads a subdomains file and a mutation dictionary and writes a file and a folder of resolved results. Run it after passive discovery like subfinder to reach names those sources miss, then hand the live hosts to httpx for probing.