loading
Loading content
loading
Recon
A fast domain resolver and subdomain bruteforcing tool that filters out wildcards and poisoned entries.
overview
Wildcard DNS makes every random name answer, so a naive brute-force fills with junk. puredns wraps massdns for high-volume resolve or bruteforce, then strips wildcard hits and poisoned answers. Survivors should be names that resolve for real.
Bruteforce mode takes a domain and a wordlist. Resolve mode takes an existing name list and confirms which answer. Use a public --resolvers pool for throughput, --resolvers-trusted to re-check survivors, and --rate-limit when the pool fights back. Raise --wildcard-tests when load-balanced DNS hides the catch-all.
In a Trickest workflow, feed names from subfinder or a wordlist into the puredns node. It writes a file and a folder of clean resolved subdomains for httpx and later stages. Schedule the run to re-resolve the surface so dead names drop and new ones show up.
source github.com/d3mondev/puredns
use cases
Run bruteforce mode with a wordlist against a domain and let wildcard filtering strip the false positives so only real subdomains survive.
Feed subdomains gathered from passive sources into resolve mode to confirm which actually resolve before spending probe time on them.
Use a public resolver pool for throughput and a trusted set for validation so DNS poisoning and load balancing do not corrupt the results.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Operating mode: bruteforce or resolve. |
| domain | STRING | · | Domain to brute-force (bruteforce mode only). |
| wordlist | FILE | · | Wordlist for bruteforce mode, or the list of names to resolve. |
| resolvers | FILE | --resolvers | File of public resolvers to query for throughput. |
| resolvers-trusted | FILE | --resolvers-trusted | File of trusted resolvers used to validate hits. |
| rate-limit | STRING | --rate-limit | Queries-per-second cap for public resolvers (0 = unlimited). |
| wildcard-tests | STRING | --wildcard-tests | Probes run to detect DNS load balancing (default 3). |
| skip-wildcard-filter | BOOLEAN | --skip-wildcard-filter | Turn off wildcard detection and filtering. |
Showing key inputs. puredns exposes 16 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| mode | STRING | · | Available modes: bruteforce, resolve |
| quiet | BOOLEAN | --quiet | quiet mode |
| domain | STRING | · | Domain name (available in 'bruteforce' mode only) |
| domains | FILE | --domains | text file containing domains to bruteforce |
| threads | STRING | --threads | number of threads to use while filtering wildcards (default 100) |
| wordlist | FILE | · | Wordlist used for bruteforcing in 'bruteforce' mode or list of domains in 'resolve' mode |
| resolvers | FILE | --resolvers | text file containing public resolvers |
| rate-limit | STRING | --rate-limit | limit total queries per second for public resolvers (0 = unlimited) (default unlimited) |
| trusted-only | BOOLEAN | --trusted-only | use only trusted resolvers (implies --skip-validation) |
| skip-sanitize | BOOLEAN | --skip-sanitize | do not sanitize the list of domains to test |
| wildcard-batch | STRING | --wildcard-batch | number of subdomains to test for wildcards in a single batch (0 = unlimited) (default unlimited) |
| wildcard-tests | STRING | --wildcard-tests | number of tests to perform to detect DNS load balancing (default 3) |
| skip-validation | BOOLEAN | --skip-validation | do not validate results with trusted resolvers |
| resolvers-trusted | FILE | --resolvers-trusted | text file containing trusted resolvers |
| rate-limit-trusted | STRING | --rate-limit-trusted | limit total queries per second for trusted resolvers (0 = unlimited) (default 500) |
| skip-wildcard-filter | BOOLEAN | --skip-wildcard-filter | do not perform wildcard detection and filtering |
example
# brute-force example.com against a wordlist, wildcards filtered outpuredns bruteforce wordlist.txt example.com \ --resolvers resolvers.txt --resolvers-trusted trusted.txt \ --wildcard-tests 5 --rate-limit 1500www.example.comapi.example.commail.example.comdev.example.comstaging.example.comvpn.example.comblog.example.comadmin.example.comcdn.example.comguidance
Reach for puredns when you need high-volume subdomain resolution or bruteforce with wildcards filtered out. It wraps massdns and adds trusted validation so poisoned or catch-all answers do not pollute the list. Pair it with subfinder for discovery, then httpx to see what speaks HTTP.
Raw high-speed stub resolver. puredns wraps it and adds wildcard detection plus trusted validation.
Another massdns wrapper with a different wildcard algorithm. Peer drop-in when you want speed over puredns's trusted re-check pass.
Passive subdomain discovery. Feed its output into puredns resolve mode before probing.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain and a wordlist feed puredns, which brute-forces and resolves names, filters out wildcards, and writes the clean resolved subdomains as output.
Facts on this page come from the live Trickest tool library.