loading
Loading content
loading
Recon
Generate DNS wordlists through permutations.
overview
gotator takes a list of known subdomains and a list of permutation words and mixes them to produce candidate hostnames you have not seen yet. If you know dev.example.com and api.example.com, gotator generates names like dev-api.example.com and api.dev.example.com, the predictable variations an organization tends to create but never publishes.
It does not resolve anything itself. gotator is a generator that feeds a DNS brute-force resolver. -depth controls how many permutation passes it runs, -numbers walks digits up and down, -adv adds hyphen-joined and word-swapped forms, and -mindup keeps the output lean on heavy workloads so the resolver does not waste time on repeats.
On Trickest, gotator is a Recon node that takes a subdomains file and a permutations file and writes a file and a folder of candidate names. Run it after passive discovery, then pipe its output into a resolver like puredns or shuffledns to find which of the generated names exist.
source github.com/Josue87/gotator
use cases
Feed gotator the subdomains you already found and a permutation word list to generate plausible new hostnames for a resolver to test.
Generate variations like env prefixes, hyphenated joins, and numbered hosts so a brute-force pass catches names an organization created but never published.
Raise -depth for more aggressive passes and set -numbers to walk digits up and down across the generated names, then cap output with -mindup.
Turn on -mindup so a large permutation job drops repeats and the downstream resolver spends its budget on unique candidates.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | -sub | List of known subdomains to permute. |
| permutations | FILE | -perm | List of permutation words to combine with the subdomains. |
| depth | STRING | -depth | Number of permutation passes, between 1 and 3 (default 1). |
| numbers | STRING | -numbers | Iterate numbers found in permutations up and down by this amount. |
| threads | STRING | -t | Maximum Go routines to use (default 100). |
| minimize-duplicates | BOOLEAN | -mindup | Drop duplicate output, recommended for heavy workloads. |
| extract-subs | BOOLEAN | -md | Extract previous domains and subdomains from the input list. |
| advanced | BOOLEAN | -adv | Generate richer permutations using subdomains, words, and hyphen joins. |
Showing key inputs. gotator exposes 11 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | -sub | List of subdomains to be swapped. |
| permutations | FILE | -perm | List of permutations. |
| depth | STRING | -depth | Configure the permutation depth, between 1 and 3 (default 1). |
| numbers | STRING | -numbers | Number of iterations to run on numbers found in permutations, up and down (default 0, skip). Penalizes performance, use small numbers. |
| threads | STRING | -t | Max Go routines (default 100). |
| advanced | BOOLEAN | -adv | Generate permutations with subdomains and hyphen-joined words, and append the permutation word at the back (depth 1). |
| prefixes | BOOLEAN | -prefixes | Add the default gotator prefixes to permutations. If perm is also given, the two are merged. |
| extract-subs | BOOLEAN | -md | Extract previous domains and subdomains from the names in the sub list. |
| minimize-duplicates | BOOLEAN | -mindup | Minimize duplicate output. Recommended for heavy workloads. |
| fast | BOOLEAN | -fast | Do not check root domains (may go out of scope). |
| silent | BOOLEAN | -silent | Do not display the gotator banner. |
example
# permute known subdomains against a word list, drop duplicatesgotator -sub subdomains.txt -perm permutations.txt -depth 2 -numbers 5 -mindup -silent > candidates.txtdev-api.example.comapi.dev.example.comstaging-api.example.comapi2.example.comapp.staging.example.comstaging-app.example.comadmin-dev.example.comvpn2.example.commail-staging.example.comapi.admin.example.com… (18,392 candidate names generated from 24 subdomains)guidance
Use gotator to grow a candidate hostname list from subdomains you already discovered, then resolve the output to find the real ones. It generates names, it does not test them, so always follow it with a resolver like puredns or shuffledns. For passive discovery first, run subfinder.
Classic subdomain permutation generator. gotator adds depth control and number iteration.
Permutes names from a seed list. A close sibling for the same generate-then-resolve flow.
Go altdns variant for permutation generation. Same role, different option set.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
Known subdomains feed gotator, which permutes them into candidate names and hands them to puredns so only resolving hosts land as output.
Facts on this page come from the live Trickest tool library.