loading
Loading content
loading
Recon
Wordlist-driven subdomain permutations from known hosts.
overview
Place goaltdns between subdomain discovery and a DNS resolver. Feed seeds with -l or -h, point -w at a short permutation wordlist, and it writes a file and folder of candidate names for dnsx, puredns, or shuffledns.
Use it when you already have real hostnames and want dashed, numbered, and indexed variants shaped by the target. Keep -w small (dev, staging, api, internal) so the later resolve stage stays manageable.
Unlike a full subdomain brute force against the apex, goaltdns mutates names you already found. It does not resolve DNS. Trickest hosts it as a managed Recon node; wire output into a resolver or you only get unverified strings.
use cases
Feed discovered names and a wordlist into goaltdns to generate dashed, numbered, and indexed variants tuned to the target's naming.
Pass a file of live hosts with -l so goaltdns applies its permutation logic across the whole set rather than one host at a time.
Resolve the permuted names to surface obscure subdomains that certificate logs and DNS aggregators never recorded.
Point -w at a small permutation wordlist of real segments like dev, staging, api, and internal so the tool generates believable variants instead of noise.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| wordlist | FILE | -w | Custom wordlist used to permute the seed names. |
| live-hosts | FILE | -l | List of live hosts to permute. |
| host-to-permutate | STRING | -h | A single host to permute. |
Showing key inputs. goaltdns exposes 3 inputs in total.
example
# permute known hosts against a wordlist, save the candidate namesgoaltdns -l known-hosts.txt -w permutations.txt -o goaltdns-out.txtadmin.dev.example.comdev-admin.example.comdev.admin.example.comapi-staging.example.comstaging-api.example.comstaging1.example.comstaging-2.example.comdev.api.example.comapi-dev.example.commail-vpn.example.comguidance
Use after subdomain discovery and before a DNS resolver, when you want wordlist-driven permutations from known hosts. It generates names only. Follow with dnsx, puredns, or shuffledns. Prefer alterx or gotator when you need pattern templates or depth controls.
Pattern-driven permutation generator with -pattern and -enrich. Prefer when you need a DSL over a simple -w wordlist.
Permutation generator with depth and number options. Close peer when those knobs matter more than a plain wordlist.
Generates name variants from a domain list. Pair any of these with a resolver to confirm hits.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
Known hosts feed goaltdns, which permutes them against a wordlist and passes the candidates to dnsx so only names that resolve land as output.
Facts on this page come from the live Trickest tool library.