Recon
Generate DNS permutation candidates from known subs
DNS wordlists through subdomain permutations.
overview
What gotator does
gotator mixes a known-subdomains file (-sub) with a permutation word list (-perm) to emit candidate hostnames you have not seen yet.
It does not resolve. -depth (1-3) sets permutation passes, -numbers walks digits, -adv adds hyphen joins and word swaps, and -mindup drops repeats on heavy runs.
Trickest provides gotator as a managed Recon node: two files in, FILE and FOLDER of candidates out. Run after passive discovery, then resolve with puredns or shuffledns.
source github.com/Josue87/gotator
use cases
Where gotator fits
Expand a known subdomain set
Feed gotator the subdomains you already found and a permutation word list to generate plausible new hostnames for a resolver to test.
Catch predictable naming patterns
Generate variations like env prefixes, hyphenated joins, and numbered hosts so a brute-force pass catches names an organization created but never published.
Tune permutation depth and numbers
Raise -depth for more aggressive passes and set -numbers to walk digits up and down across the generated names, then cap output with -mindup.
Keep heavy runs lean
Turn on -mindup so a large permutation job drops repeats and the downstream resolver spends its budget on unique candidates.
reference
gotator inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | -sub | List of known subdomains to permute. |
| permutations | FILE | -perm | List of permutation words to combine with the subdomains. |
| depth | STRING | -depth | Number of permutation passes, between 1 and 3 (default 1). |
| numbers | STRING | -numbers | Iterate numbers found in permutations up and down by this amount. |
| threads | STRING | -t | Maximum Go routines to use (default 100). |
| minimize-duplicates | BOOLEAN | -mindup | Drop duplicate output, recommended for heavy workloads. |
| extract-subs | BOOLEAN | -md | Extract previous domains and subdomains from the input list. |
| advanced | BOOLEAN | -adv | Generate richer permutations using subdomains, words, and hyphen joins. |
Showing key inputs. gotator exposes 11 inputs in total.
Full flag reference (11 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| subdomains | FILE | -sub | List of subdomains to be swapped. |
| permutations | FILE | -perm | List of permutations. |
| depth | STRING | -depth | Configure the permutation depth, between 1 and 3 (default 1). |
| numbers | STRING | -numbers | Number of iterations to run on numbers found in permutations, up and down (default 0, skip). Penalizes performance, use small numbers. |
| threads | STRING | -t | Max Go routines (default 100). |
| advanced | BOOLEAN | -adv | Generate permutations with subdomains and hyphen-joined words, and append the permutation word at the back (depth 1). |
| prefixes | BOOLEAN | -prefixes | Add the default gotator prefixes to permutations. If perm is also given, the two are merged. |
| extract-subs | BOOLEAN | -md | Extract previous domains and subdomains from the names in the sub list. |
| minimize-duplicates | BOOLEAN | -mindup | Minimize duplicate output. Recommended for heavy workloads. |
| fast | BOOLEAN | -fast | Do not check root domains (may go out of scope). |
| silent | BOOLEAN | -silent | Do not display the gotator banner. |
example
Run gotator
# permute known subdomains against a word list, drop duplicatesgotator -sub subdomains.txt -perm permutations.txt -depth 2 -numbers 5 -mindup -silent > candidates.txtdev-api.example.comapi.dev.example.comstaging-api.example.comapi2.example.comapp.staging.example.comstaging-app.example.comadmin-dev.example.comvpn2.example.commail-staging.example.comapi.admin.example.com… (18,392 candidate names generated from 24 subdomains)guidance
Choosing gotator
Use gotator to grow a candidate hostname list from subdomains you already found, then resolve the output. It generates names; it does not test them. Always follow with a resolver like puredns or shuffledns. For passive discovery first, run subfinder.
altdns
Classic subdomain permutation generator. gotator adds depth control and number iteration.
dnsgen
Permutes names from a seed list. Same generate-then-resolve role.
goaltdns
Go altdns variant for permutation generation. Same job, different option set.
faq
gotator questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run gotator yourself
Known subdomains feed gotator, which permutes them into candidate names and hands them to puredns so only resolving hosts land as output.
Facts on this page come from the live Trickest tool library.