When should I use --targets instead of a single domain?

Pass --targets with one domain per line to brute-force many zones in one run with the same --subs list. Use the positional target when you only need one domain.

Does subbrute permute or recurse on found names?

No. It resolves exactly the labels in --subs. For permutation-style guesses, build a mutated list with gotator or altdns first, then feed that file to --subs.

subbrute vs subfinder or aiodnsbrute?

subfinder is passive and touches no target DNS. aiodnsbrute brute-forces asynchronously, typically against chosen resolvers. subbrute brute-forces a wordlist and routes lookups through open resolvers so the zone's name servers are not the query path. Run passive and brute, then merge.

How do I print DNS record data, not just hostnames?

Enable -p to print data from found records instead of the hostname alone. Use --verbose when tuning resolvers or --process_count.

Updated Jul 14, 2026

Recon

Resolve subdomain wordlists through open resolvers

DNS subdomain brute force routed through open resolvers.

Brute-force names passive tools miss Stay off the target's name servers Combine with passive enumeration

overview

What subbrute does

subbrute takes a domain and a --subs wordlist of candidate labels, then resolves each name. It finds hosts that never appear in certificate logs, search indexes, or DNS aggregators because those sources only list what was already published.

Lookups go through a pool of open resolvers via --resolvers instead of the target name servers. That spreads query load and keeps brute-force traffic off the zone's infrastructure. Raise --process_count when the wordlist is large; pass --targets to brute several domains in one run.

Reach for it after a passive pass such as subfinder has run dry. Trickest runs subbrute as a managed Recon node that writes resolved names to a file and folder. Merge with passive results, then probe with httpx. It resolves names; it does not fetch HTTP.

source github.com/TheRook/subbrute

use cases

Where subbrute fits

Brute-force names passive tools miss

Resolve a wordlist against a domain to find subdomains that never show up in certificate logs or search-engine sources.

Stay off the target's name servers

Route queries through open resolvers so brute forcing dodges rate limits and sends no direct traffic to the target's DNS.

Combine with passive enumeration

Merge subbrute's brute-forced names with a passive finder's output for a fuller subdomain set before probing.

Enumerate many domains at once

Supply a --targets file of domains and brute-force every one of them in a single pass.

reference

subbrute inputs and flags

7 inputs

Name	Type	Flag	Description
target	STRING	·	Target domain to brute-force subdomains for (positional).
subs	FILE	--subs	A file with the list of candidate subdomain labels to try.
targets	FILE	--targets	A file of newline-delimited domains to brute-force in one run.
resolvers	FILE	--resolvers	A file of DNS resolvers; falls back to the internal resolvers.txt if empty.
process-count	STRING	--process_count	Number of lookup threads to run (default 8).
print-data	BOOLEAN	-p	Print the data from found DNS records instead of the hostname alone (default false).

Showing key inputs. subbrute exposes 7 inputs in total.

Full flag reference (7 inputs)

Name	Type	Flag	Description
subs	FILE	--subs	A file with the list of candidate subdomain labels.
target	STRING	·	Target domain to brute-force subdomains for (positional).
targets	FILE	--targets	A file containing a newline-delimited list of domains to brute-force.
verbose	BOOLEAN	--verbose	Print debug information.
resolvers	FILE	--resolvers	A file with a list of DNS resolvers; uses the internal resolvers.txt if empty.
print-data	BOOLEAN	-p	Print data from found DNS records (default false).
process-count	STRING	--process_count	Number of lookup threads to run (default 8).

example

Run subbrute

subbrute · command

# brute-force subdomains through open resolvers, 16 lookup threadssubbrute --subs /wordlists/dns/names.txt --resolvers resolvers.txt --process_count 16 example.com

sample output

ns1.example.commail.example.comvpn.example.comapi.example.comdev.example.comstaging.example.comautodiscover.example.comowa.example.com

guidance

Choosing subbrute

Use subbrute for active subdomain brute forcing when passive sources miss guessable names. Pair with subfinder for coverage, then httpx for live hosts. Prefer aiodnsbrute when you want async resolution without open-resolver routing.

subfinder

Passive enumeration from datasets. subbrute brute-forces names; run both and merge.

aiodnsbrute

Async DNS brute-forcer. subbrute routes queries through open resolvers to stay off the target name servers.

faq

subbrute questions

Pass candidate labels in --subs, one per line. subbrute prepends each label to the target, resolves through the --resolvers pool (or bundled resolvers.txt), and keeps names that answer. Dead resolvers slow the run, so refresh the pool before a large wordlist.

Run subbrute yourself

A domain and a subdomain wordlist feed subbrute, which resolves names through open resolvers and writes the discovered subdomains as output.

Open subbrute in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Resolve subdomain wordlists through open resolvers

What subbrute does

Where subbrute fits

Brute-force names passive tools miss

Stay off the target's name servers

Combine with passive enumeration

Enumerate many domains at once

subbrute inputs and flags

Run subbrute

Choosing subbrute

subfinder

aiodnsbrute

subbrute questions

More Recon tools

amass

amass-intel

assetfinder

bbot

bevigil

cloud-enum

Run subbrute yourself