Recon
Resolve wordlist DNS names with gobuster
DNS subdomain brute force with wildcard handling.
overview
What gobuster-dns does
Feed -d and -w into gobuster dns to resolve each candidate name and write the subdomains that exist. Run it beside passive discovery, then probe the merged set with httpx.
Use it when certificate logs and aggregators look thin and you want direct wordlist resolution. Enable --wildcard so a catch-all zone does not mark every guess as a hit. Point -r at a trusted resolver; use -i or -c for IP or CNAME enrichment (not both).
shuffledns and puredns scale better on very large wordlists. gobuster dns stays the gobuster-mode path with simple -t and --timeout controls. Trickest hosts it as a managed Recon node.
source github.com/OJ/gobuster
use cases
Where gobuster-dns fits
Brute-force subdomains a domain hides
Resolve every name in a wordlist against the target domain to surface hosts that passive sources and certificate logs never recorded.
Avoid wildcard false positives
Enable wildcard handling so a catch-all DNS record does not make every guessed name look like a real, resolving host.
Enrich results with IP or CNAME
Turn on show-ip or show-cname so each found subdomain comes back with its address or alias, ready for the probing stage.
Point at a trusted resolver
Set a custom DNS server with -r when you need a faster public resolver or one you trust for accuracy during a long wordlist run.
reference
gobuster-dns inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | The target domain |
| wordlist | FILE | -w | Path to the wordlist |
| resolver | STRING | -r | Use custom DNS server (format server.com or server.com:port) |
| threads | STRING | -t | Number of concurrent threads (default 10) |
| timeout | STRING | --timeout | DNS resolver timeout (default 1s) |
| show-ip | BOOLEAN | -i | Show IP addresses |
| force-wildcard | BOOLEAN | --wildcard | Force continued operation when wildcard found |
| show-cname | BOOLEAN | -c | Show CNAME records (cannot be used with '-i' option) |
Showing key inputs. gobuster-dns exposes 8 inputs in total.
example
Run gobuster-dns
# gobuster-dns: wordlist brute force with IPs, continue past wildcardsgobuster dns -d example.com -w subdomains.txt -t 50 -i --wildcardFound: www.example.comFound: api.example.comFound: mail.example.comFound: staging.example.comFound: dev.example.comFound: vpn.example.comFound: portal.example.comFound: status.example.comguidance
Choosing gobuster-dns
Use gobuster-dns to brute-force subdomains by resolving wordlist names against a domain, especially for hosts passive sources miss. Pair with subfinder for passive coverage, then feed the merged resolved set to httpx. Prefer shuffledns or puredns for very large wordlists.
shuffledns
massdns-backed brute forcing and resolution. Prefer on very large wordlists when gobuster dns throughput is the bottleneck.
puredns
High-speed resolver and brute forcer with strong wildcard filtering. Prefer when wildcard hygiene and scale both matter.
subfinder
Passive discovery rather than brute forcing. Complementary source for the same subdomain goal.
faq
gobuster-dns questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run gobuster-dns yourself
A domain and a wordlist feed gobuster-dns, which resolves each candidate and writes the subdomains that exist as a queryable output.
Facts on this page come from the live Trickest tool library.