Recon
Build subdomain candidates for DNS brute force
Subdomain candidates from a wordlist for DNS resolution.
overview
What mksub does
mksub combines a domain with a wordlist to emit candidate subdomains for later resolution. It lowercases words, strips invalid hostname characters, and drops duplicates.
Level (-l) stacks labels. -r filters the wordlist before generation. -df builds candidates for many roots in one pass. -silent skips stdout when you only need the file.
Trickest provides mksub as a managed Recon node: domain and wordlist in, FILE and FOLDER of candidates out. Resolve with puredns or dnsx; pair with passive tools like subfinder.
source github.com/trickest/mksub
use cases
Where mksub fits
Build a brute-force resolution list
Permute a domain against a wordlist, then resolve the candidates with puredns or dnsx to find subdomains that passive sources never indexed.
Reach nested subdomain schemes
Set the level flag above 1 to generate multi-label hostnames so discovery catches naming patterns like api.staging.example.com.
Permute across a portfolio of domains
Pass a domain file with one root per line to generate candidates for a whole set of domains in a single run.
Complement passive enumeration
Run mksub-driven brute forcing alongside subfinder so active permutation fills the gaps that passive certificate and DNS feeds leave behind.
reference
mksub inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to generate permutations for. |
| wordlist | FILE | -w | Wordlist for permutations. |
| domain-list | FILE | -df | Input domain file, one domain per line. |
| level | STRING | -l | Subdomain level to generate; level 1 produces sub.domain.com, level 2 sub.sub.domain.com (default 1). |
| regex-filter | STRING | -r | Regex to filter words from the wordlist file. |
| silent | BOOLEAN | -silent | Skip writing generated subdomains to stdout for a faster run (default true). |
Showing key inputs. mksub exposes 6 inputs in total.
example
Run mksub
# permute example.com against a wordlist, filtering to hostname-safe wordsmksub -d example.com -w subdomains.txt -r '^[a-z0-9-]+$' -l 1 > candidates.txtapi.example.comdev.example.comstaging.example.commail.example.comvpn.example.comadmin.example.comgitlab.example.comgrafana.example.com… (1,000 candidates generated for example.com)guidance
Choosing mksub
Use mksub when you want active subdomain brute force and need a clean candidate list first. It generates names; a resolver like puredns or dnsx confirms which ones exist. Pair with subfinder for passive coverage.
subfinder
Passive subdomain discovery from online sources. mksub generates names to brute force instead; run both for breadth.
dnsgen
Permutation generator that mutates known subdomains. mksub builds from a wordlist and domain rather than existing names.
mkpath
Sibling generator for URL paths instead of subdomains. Same wordlist approach on the HTTP layer.
faq
mksub questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run mksub yourself
A wordlist feeds mksub, which permutes it against a domain and hands the candidates to puredns for resolution before the live subdomains land as a queryable output.
Facts on this page come from the live Trickest tool library.