loading
Loading content
loading
Recon
massdns wrapper for active subdomain brute force and resolution with wildcard filtering.
overview
shuffledns wraps massdns for two jobs: brute-force new names from a wordlist (-w) against a domain (-d), or resolve an existing candidate list (-list) through resolvers (-r).
Wildcard DNS answers flood naive brute-force runs. -strict-wildcard checks each hit; -wt tunes concurrent wildcard checks so false positives do not drown real hosts.
Sit it after a passive subdomain source when you need live answers, or in brute mode when wordlist coverage matters. Feed resolved hosts to a prober next.
use cases
Feed a domain, a wordlist, and a resolver list to discover new subdomains fast, with wildcard responses filtered out automatically.
Run resolve mode over subdomains gathered from passive sources to confirm which ones answer before probing.
Use strict wildcard checking so domains that answer for any name do not flood the result set with hosts that do not exist.
Raise concurrent massdns resolves and wildcard checks to push a large wordlist through quickly without overwhelming the resolvers.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to find or resolve subdomains for. |
| wordlist | FILE | -w | File of words to brute-force subdomains from. |
| resolvers | FILE | -r | File of DNS resolvers to use for enumeration. |
| subdomains | FILE | -list | File of subdomains to resolve in resolve mode. |
| strict-wildcard | BOOLEAN | -strict-wildcard | Perform a wildcard check on every found subdomain. |
| massdns-command | STRING | -massdns-cmd | Optional massdns commands to forward (example '-i 10'). |
| massdns-resolves | STRING | -t | Number of concurrent massdns resolves (default 10000). |
| show-only-subdomains | BOOLEAN | -silent | Show only subdomains in the output. |
Showing key inputs. shuffledns exposes 12 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain to find or resolve subdomains for. |
| no-color | BOOLEAN | -no-color | don't use colors in output |
| wordlist | FILE | -w | file containing words for subdomain bruteforce |
| resolvers | FILE | -r | file containing resolvers for enumeration |
| subdomains | FILE | -list | file containing list of subdomains to resolve |
| massdns-input | FILE | -raw-input | file containing full massdns output |
| massdns-command | STRING | -massdns-cmd | optional massdns commands to run (example '-i 10') |
| strict-wildcard | BOOLEAN | -strict-wildcard | perform wildcard check on all found subdomains |
| massdns-resolves | STRING | -t | number of concurrent massdns resolves (default 10000) |
| number-of-retries | STRING | -retries | number of retries for DNS enumeration (default 5) |
| show-only-subdomains | BOOLEAN | -silent | show only subdomains in output |
| number-of-wildcard-checks | STRING | -wt | number of concurrent wildcard checks (default 25) |
example
# brute-force subdomains from a wordlist with wildcard filteringshuffledns -d example.com -w subdomains.txt -r resolvers.txt -strict-wildcard -o resolved.txtwww.example.comapi.example.commail.example.comdev.example.comstaging.example.comvpn.example.comadmin.example.comgrafana.example.com… (valid hosts after wildcard filtering; a full wordlist run against a live domain returns many more)guidance
Use shuffledns for active subdomain brute force or high-speed resolution when you have a resolver list (-r). For passive names with no traffic to the target, pull from securitytrails-subdomains first, then resolve here.
Passive subdomain source. Feed its output into shuffledns -list resolve mode to validate hosts.
Service intelligence rather than DNS brute force. A different recon lens on the same target.
Web-server file exposure checks. Run later against resolved hosts, not for DNS discovery.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain and a wordlist feed shuffledns, which brute-forces and resolves subdomains with wildcard filtering and writes the valid hosts.
Facts on this page come from the live Trickest tool library.