loading
Loading content
loading
Recon
Generate subdomain permutations to surface hosts others miss.
overview
goaltdns takes subdomains you already know and permutes them against a wordlist, inserting indexes, numbers, and dashes to produce new candidate names. The idea is that an organization's naming is regular: if dev and api exist, then dev-api, api2, and staging-api are plausible too. Generating those variants raises the odds of finding an obscure host that passive enumeration and a generic wordlist both missed.
It works from either a single host or a list of live hosts, applying the same permutation logic across the set. The output is a candidate list, not resolved hosts, so goaltdns multiplies your seed names into something a resolver can confirm. That keeps the generation step fast and pushes the network work to a dedicated DNS stage.
On Trickest, goaltdns is a Recon node that reads a wordlist and seed hosts and writes a file and a folder of permuted names. Place it between subdomain discovery and a DNS resolver: discovery finds the seeds, goaltdns expands them, and the resolver confirms which permutations exist.
use cases
Feed discovered names and a wordlist into goaltdns to generate dashed, numbered, and indexed variants tuned to the target's naming.
Pass a file of live hosts with -l so goaltdns applies its permutation logic across the whole set rather than one host at a time.
Resolve the permuted names to surface obscure subdomains that certificate logs and DNS aggregators never recorded.
Point -w at a small permutation wordlist of real segments like dev, staging, api, and internal so the tool generates believable variants instead of noise.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| wordlist | FILE | -w | Custom wordlist used to permute the seed names. |
| live-hosts | FILE | -l | List of live hosts to permute. |
| host-to-permutate | STRING | -h | A single host to permute. |
Showing key inputs. goaltdns exposes 3 inputs in total.
example
# permute known hosts against a wordlist, save the candidate namesgoaltdns -l known-hosts.txt -w permutations.txt -o goaltdns-out.txtadmin.dev.example.comdev-admin.example.comdev.admin.example.comapi-staging.example.comstaging-api.example.comstaging1.example.comstaging-2.example.comdev.api.example.comapi-dev.example.commail-vpn.example.comguidance
Use goaltdns after subdomain discovery and before a DNS resolver, when you want wordlist-driven name permutations from known hosts. It generates names, it does not resolve them, so follow it with a resolver such as dnsx, puredns, or shuffledns.
Pattern-driven permutation generator with more configurable control over the output.
Permutation generator with depth and number options; a close alternative for altered names.
Generates name variants from a list of domains; pair any of these with a resolver.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
Known hosts feed goaltdns, which permutes them against a wordlist and passes the candidates to dnsx so only names that resolve land as output.
Facts on this page come from the live Trickest tool library.