Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 13, 2026

Recon

Resolve subdomain wordlists through open resolvers

SubBrute is a Python subdomain enumeration tool that brute-forces subdomain names from a wordlist and resolves them through open DNS resolvers, so its queries are not sent directly to the target's name servers.

Python · GPL-3.0 license

Agent
Brute-force names passive tools missStay off the target's name serversCombine with passive enumeration

overview

What subbrute does

subbrute takes a domain and a --subs wordlist of candidate labels, then resolves each name. It finds hosts that never appear in certificate logs, search indexes, or DNS aggregators because those sources only list what was already published.

Lookups go through a pool of open resolvers via --resolvers instead of the target name servers. That spreads query load and keeps brute-force traffic off the zone's infrastructure. Raise --process_count when the wordlist is large; pass --targets to brute several domains in one run.

Reach for it after a passive pass such as subfinder has run dry. Trickest runs subbrute as a managed Recon node that writes resolved names to a file and folder. Merge with passive results, then probe with httpx. It resolves names; it does not fetch HTTP.

source github.com/TheRook/subbrute

use cases

Where subbrute fits

Brute-force names passive tools miss

Resolve a wordlist against a domain to find subdomains that never show up in certificate logs or search-engine sources.

Stay off the target's name servers

Route queries through open resolvers so brute forcing dodges rate limits and sends no direct traffic to the target's DNS.

Combine with passive enumeration

Merge subbrute's brute-forced names with a passive finder's output for a fuller subdomain set before probing.

Enumerate many domains at once

Supply a --targets file of domains and brute-force every one of them in a single pass.

reference

subbrute inputs and flags

7 inputs
NameTypeFlagDescription
targetSTRING·Target domain to brute-force subdomains for (positional).
subsFILE--subsA file with the list of candidate subdomain labels to try.
targetsFILE--targetsA file of newline-delimited domains to brute-force in one run.
resolversFILE--resolversA file of DNS resolvers; falls back to the internal resolvers.txt if empty.
process-countSTRING--process_countNumber of lookup threads to run (default 8).
print-dataBOOLEAN-pPrint the data from found DNS records instead of the hostname alone (default false).

Showing key inputs. subbrute exposes 7 inputs in total.

Full flag reference (7 inputs)
NameTypeFlagDescription
subsFILE--subsA file with the list of candidate subdomain labels.
targetSTRING·Target domain to brute-force subdomains for (positional).
targetsFILE--targetsA file containing a newline-delimited list of domains to brute-force.
verboseBOOLEAN--verbosePrint debug information.
resolversFILE--resolversA file with a list of DNS resolvers; uses the internal resolvers.txt if empty.
print-dataBOOLEAN-pPrint data from found DNS records (default false).
process-countSTRING--process_countNumber of lookup threads to run (default 8).

example

Run subbrute

subbrute · command
# brute-force subdomains through open resolvers, 16 lookup threads
subbrute --subs /wordlists/dns/names.txt --resolvers resolvers.txt --process_count 16 example.com
sample output
ns1.example.com
mail.example.com
vpn.example.com
api.example.com
dev.example.com
staging.example.com
autodiscover.example.com
owa.example.com

guidance

Choosing subbrute

Use subbrute for active subdomain brute forcing when passive sources miss guessable names. Pair with subfinder for coverage, then httpx for live hosts. Prefer aiodnsbrute when you want async resolution without open-resolver routing.

subfinder

Passive enumeration from datasets. subbrute brute-forces names; run both and merge.

aiodnsbrute

Async DNS brute-forcer. subbrute routes queries through open resolvers to stay off the target name servers.

faq

subbrute questions

Pass candidate labels in --subs, one per line. subbrute prepends each label to the target, resolves through the --resolvers pool (or bundled resolvers.txt), and keeps names that answer. Dead resolvers slow the run, so refresh the pool before a large wordlist.

Pass --targets with one domain per line to brute-force many zones in one run with the same --subs list. Use the positional target when you only need one domain.

Yes, as a DNS spider: when a lookup returns new hostnames under the target, such as CNAME or NS targets, subbrute queues them too. It does not permute labels; for permutation-style guesses, build a mutated list with gotator or altdns first, then feed that file to --subs.

subfinder is passive and touches no target DNS. aiodnsbrute brute-forces asynchronously, typically against chosen resolvers. subbrute brute-forces a wordlist and routes lookups through open resolvers so the zone's name servers are not the query path. Run passive and brute, then merge.

Enable -p to print data from found records instead of the hostname alone. Use --verbose when tuning resolvers or --process_count.

If you don't pass --subs, subbrute uses the names.txt file shipped in its repository, which the README says contains 101,010 subdomain labels. The repository also ships a smaller names_small.txt for quicker runs.

subbrute ships its own resolvers.txt and uses it when --resolvers is not set, but the repository has not been updated since 2017. Trickest publishes a resolvers.txt at github.com/trickest/resolvers that a scheduled workflow re-validates with dnsvalidator; pass that file with --resolvers. trickest/resolvers on GitHub.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run subbrute yourself

A domain and a subdomain wordlist feed subbrute, which resolves names through open resolvers and writes the discovered subdomains as output.

Open subbrute in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.