loading
Loading content
loading
Recon
DNS subdomain brute force with wildcard handling.
overview
Feed -d and -w into gobuster dns to resolve each candidate name and write the subdomains that exist. Run it beside passive discovery, then probe the merged set with httpx.
Use it when certificate logs and aggregators look thin and you want direct wordlist resolution. Enable --wildcard so a catch-all zone does not mark every guess as a hit. Point -r at a trusted resolver; use -i or -c for IP or CNAME enrichment (not both).
shuffledns and puredns scale better on very large wordlists. gobuster dns stays the gobuster-mode path with simple -t and --timeout controls. Trickest hosts it as a managed Recon node.
source github.com/OJ/gobuster
use cases
Resolve every name in a wordlist against the target domain to surface hosts that passive sources and certificate logs never recorded.
Enable wildcard handling so a catch-all DNS record does not make every guessed name look like a real, resolving host.
Turn on show-ip or show-cname so each found subdomain comes back with its address or alias, ready for the probing stage.
Set a custom DNS server with -r when you need a faster public resolver or one you trust for accuracy during a long wordlist run.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | The target domain |
| wordlist | FILE | -w | Path to the wordlist |
| resolver | STRING | -r | Use custom DNS server (format server.com or server.com:port) |
| threads | STRING | -t | Number of concurrent threads (default 10) |
| timeout | STRING | --timeout | DNS resolver timeout (default 1s) |
| show-ip | BOOLEAN | -i | Show IP addresses |
| force-wildcard | BOOLEAN | --wildcard | Force continued operation when wildcard found |
| show-cname | BOOLEAN | -c | Show CNAME records (cannot be used with '-i' option) |
Showing key inputs. gobuster-dns exposes 8 inputs in total.
example
# gobuster-dns: wordlist brute force with IPs, continue past wildcardsgobuster dns -d example.com -w subdomains.txt -t 50 -i --wildcardFound: www.example.comFound: api.example.comFound: mail.example.comFound: staging.example.comFound: dev.example.comFound: vpn.example.comFound: portal.example.comFound: status.example.comguidance
Use gobuster-dns to brute-force subdomains by resolving wordlist names against a domain, especially for hosts passive sources miss. Pair with subfinder for passive coverage, then feed the merged resolved set to httpx. Prefer shuffledns or puredns for very large wordlists.
massdns-backed brute forcing and resolution. Prefer on very large wordlists when gobuster dns throughput is the bottleneck.
High-speed resolver and brute forcer with strong wildcard filtering. Prefer when wildcard hygiene and scale both matter.
Passive discovery rather than brute forcing. Complementary source for the same subdomain goal.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain and a wordlist feed gobuster-dns, which resolves each candidate and writes the subdomains that exist as a queryable output.
Facts on this page come from the live Trickest tool library.