loading
Loading content
loading
Recon
Make subdomain candidates from a wordlist for DNS resolution.
overview
mksub combines a domain with a wordlist to produce candidate subdomains for resolution. It reads the wordlist, lowercases every word, strips characters that cannot appear in a hostname, drops duplicates, and emits permutations like api.example.com ready to feed a DNS resolver. The work is generation, not lookup, so it sits in front of a fast resolver.
Level control decides how many labels to stack. Level 1 yields sub.domain.com, level 2 yields sub.sub.domain.com, which reaches nested naming schemes a single-label list would miss. A regex filter trims the wordlist before generation, and a domain file builds candidates for many roots in one pass.
On Trickest, mksub is a Recon node that takes a domain and a wordlist and writes a file and a folder of candidates. Place it ahead of a resolver such as puredns or dnsx so brute-force subdomain discovery runs against a list tailored to the target's naming patterns.
source github.com/trickest/mksub
use cases
Permute a domain against a wordlist, then resolve the candidates with puredns or dnsx to find subdomains that passive sources never indexed.
Set the level flag above 1 to generate multi-label hostnames so discovery catches naming patterns like api.staging.example.com.
Pass a domain file with one root per line to generate candidates for a whole set of domains in a single run.
Run mksub-driven brute forcing alongside subfinder so active permutation fills the gaps that passive certificate and DNS feeds leave behind.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to generate permutations for. |
| wordlist | FILE | -w | Wordlist for permutations. |
| domain-list | FILE | -df | Input domain file, one domain per line. |
| level | STRING | -l | Subdomain level to generate; level 1 produces sub.domain.com, level 2 sub.sub.domain.com (default 1). |
| regex-filter | STRING | -r | Regex to filter words from the wordlist file. |
| silent | BOOLEAN | -silent | Skip writing generated subdomains to stdout for a faster run (default true). |
Showing key inputs. mksub exposes 6 inputs in total.
example
# permute example.com against a wordlist, filtering to hostname-safe wordsmksub -d example.com -w subdomains.txt -r '^[a-z0-9-]+$' -l 1 > candidates.txtapi.example.comdev.example.comstaging.example.commail.example.comvpn.example.comadmin.example.comgitlab.example.comgrafana.example.com… (1,000 candidates generated for example.com)guidance
Use mksub when you want active, brute-force subdomain discovery and need a clean candidate list first. It generates the names; a resolver like puredns or dnsx confirms which ones exist. Pair it with passive tools like subfinder for fuller coverage.
Passive subdomain discovery from online sources. mksub generates names to brute force instead; run both for breadth.
Permutation generator that mutates known subdomains. mksub builds from a wordlist and domain rather than existing names.
Sibling generator for URL paths instead of subdomains. Same wordlist-permutation approach on the HTTP layer.
faq
related
Asynchronous DNS brute-force tool for fast subdomain enumeration.
OWASP Amass: network mapping and external asset discovery.
OWASP Amass intel: find an organization's root domains and ranges.
OWASP Amass enumeration that produces structured JSON output.
Find related domains and subdomains via shared Google Analytics IDs.
Find domains and subdomains potentially related to a given domain.
A wordlist feeds mksub, which permutes it against a domain and hands the candidates to puredns for resolution before the live subdomains land as a queryable output.
Facts on this page come from the live Trickest tool library.