Brute-force DNS subdomains from a wordlist

gobuster-dns is the DNS mode of gobuster. It takes a domain and a wordlist and resolves each candidate name, reporting the subdomains that exist. Where passive enumeration reads what others have already recorded, brute forcing tries names directly, so it finds hosts that never appeared in certificate logs or DNS aggregators because nobody indexed them.

It handles the practical problems of DNS brute forcing. Wildcard support keeps a catch-all record from marking every guess as a hit, a custom resolver lets you point at a fast or trusted DNS server, and the show-ip and show-cname options enrich each result with its address or alias. Threads and a per-query timeout control how hard and how fast it pushes the resolver.

On Trickest, gobuster-dns is a Recon node that reads a domain and a wordlist and writes a file and a folder of resolved subdomains. Run it alongside passive discovery to add brute-forced names, then probe the combined set with a tool like httpx.