loading
Loading content
loading
Recon
DNS wordlists through subdomain permutations.
overview
gotator mixes a known-subdomains file (-sub) with a permutation word list (-perm) to emit candidate hostnames you have not seen yet.
It does not resolve. -depth (1-3) sets permutation passes, -numbers walks digits, -adv adds hyphen joins and word swaps, and -mindup drops repeats on heavy runs.
Trickest provides gotator as a managed Recon node: two files in, FILE and FOLDER of candidates out. Run after passive discovery, then resolve with puredns or shuffledns.
source github.com/Josue87/gotator
use cases
Feed gotator the subdomains you already found and a permutation word list to generate plausible new hostnames for a resolver to test.
Generate variations like env prefixes, hyphenated joins, and numbered hosts so a brute-force pass catches names an organization created but never published.
Raise -depth for more aggressive passes and set -numbers to walk digits up and down across the generated names, then cap output with -mindup.
Turn on -mindup so a large permutation job drops repeats and the downstream resolver spends its budget on unique candidates.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | -sub | List of known subdomains to permute. |
| permutations | FILE | -perm | List of permutation words to combine with the subdomains. |
| depth | STRING | -depth | Number of permutation passes, between 1 and 3 (default 1). |
| numbers | STRING | -numbers | Iterate numbers found in permutations up and down by this amount. |
| threads | STRING | -t | Maximum Go routines to use (default 100). |
| minimize-duplicates | BOOLEAN | -mindup | Drop duplicate output, recommended for heavy workloads. |
| extract-subs | BOOLEAN | -md | Extract previous domains and subdomains from the input list. |
| advanced | BOOLEAN | -adv | Generate richer permutations using subdomains, words, and hyphen joins. |
Showing key inputs. gotator exposes 11 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | -sub | List of subdomains to be swapped. |
| permutations | FILE | -perm | List of permutations. |
| depth | STRING | -depth | Configure the permutation depth, between 1 and 3 (default 1). |
| numbers | STRING | -numbers | Number of iterations to run on numbers found in permutations, up and down (default 0, skip). Penalizes performance, use small numbers. |
| threads | STRING | -t | Max Go routines (default 100). |
| advanced | BOOLEAN | -adv | Generate permutations with subdomains and hyphen-joined words, and append the permutation word at the back (depth 1). |
| prefixes | BOOLEAN | -prefixes | Add the default gotator prefixes to permutations. If perm is also given, the two are merged. |
| extract-subs | BOOLEAN | -md | Extract previous domains and subdomains from the names in the sub list. |
| minimize-duplicates | BOOLEAN | -mindup | Minimize duplicate output. Recommended for heavy workloads. |
| fast | BOOLEAN | -fast | Do not check root domains (may go out of scope). |
| silent | BOOLEAN | -silent | Do not display the gotator banner. |
example
# permute known subdomains against a word list, drop duplicatesgotator -sub subdomains.txt -perm permutations.txt -depth 2 -numbers 5 -mindup -silent > candidates.txtdev-api.example.comapi.dev.example.comstaging-api.example.comapi2.example.comapp.staging.example.comstaging-app.example.comadmin-dev.example.comvpn2.example.commail-staging.example.comapi.admin.example.com… (18,392 candidate names generated from 24 subdomains)guidance
Use gotator to grow a candidate hostname list from subdomains you already found, then resolve the output. It generates names; it does not test them. Always follow with a resolver like puredns or shuffledns. For passive discovery first, run subfinder.
Classic subdomain permutation generator. gotator adds depth control and number iteration.
Permutes names from a seed list. Same generate-then-resolve role.
Go altdns variant for permutation generation. Same job, different option set.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
Known subdomains feed gotator, which permutes them into candidate names and hands them to puredns so only resolving hosts land as output.
Facts on this page come from the live Trickest tool library.