loading
Loading content
loading
Recon
Subdomain candidates from a wordlist for DNS resolution.
overview
mksub combines a domain with a wordlist to emit candidate subdomains for later resolution. It lowercases words, strips invalid hostname characters, and drops duplicates.
Level (-l) stacks labels. -r filters the wordlist before generation. -df builds candidates for many roots in one pass. -silent skips stdout when you only need the file.
Trickest provides mksub as a managed Recon node: domain and wordlist in, FILE and FOLDER of candidates out. Resolve with puredns or dnsx; pair with passive tools like subfinder.
source github.com/trickest/mksub
use cases
Permute a domain against a wordlist, then resolve the candidates with puredns or dnsx to find subdomains that passive sources never indexed.
Set the level flag above 1 to generate multi-label hostnames so discovery catches naming patterns like api.staging.example.com.
Pass a domain file with one root per line to generate candidates for a whole set of domains in a single run.
Run mksub-driven brute forcing alongside subfinder so active permutation fills the gaps that passive certificate and DNS feeds leave behind.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to generate permutations for. |
| wordlist | FILE | -w | Wordlist for permutations. |
| domain-list | FILE | -df | Input domain file, one domain per line. |
| level | STRING | -l | Subdomain level to generate; level 1 produces sub.domain.com, level 2 sub.sub.domain.com (default 1). |
| regex-filter | STRING | -r | Regex to filter words from the wordlist file. |
| silent | BOOLEAN | -silent | Skip writing generated subdomains to stdout for a faster run (default true). |
Showing key inputs. mksub exposes 6 inputs in total.
example
# permute example.com against a wordlist, filtering to hostname-safe wordsmksub -d example.com -w subdomains.txt -r '^[a-z0-9-]+$' -l 1 > candidates.txtapi.example.comdev.example.comstaging.example.commail.example.comvpn.example.comadmin.example.comgitlab.example.comgrafana.example.com… (1,000 candidates generated for example.com)guidance
Use mksub when you want active subdomain brute force and need a clean candidate list first. It generates names; a resolver like puredns or dnsx confirms which ones exist. Pair with subfinder for passive coverage.
Passive subdomain discovery from online sources. mksub generates names to brute force instead; run both for breadth.
Permutation generator that mutates known subdomains. mksub builds from a wordlist and domain rather than existing names.
Sibling generator for URL paths instead of subdomains. Same wordlist approach on the HTTP layer.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A wordlist feeds mksub, which permutes it against a domain and hands the candidates to puredns for resolution before the live subdomains land as a queryable output.
Facts on this page come from the live Trickest tool library.