GoAltdns is a permutation generation tool that can take a list of subdomains, permute them using a wordlist, insert indexes, numbers, dashes and increase your chance of finding that estoeric subdomain that no-one found during bug-bounty or pentest. It uses a number of techniques to accomplish this. It can allow for discovery of subdomains that conform to patterns. GoAltdns takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of.
The tool itself is very simple and is built with golang concurrency providing it very quick execution times.
The installation is easy. Just
go get the repo.
go get github.com/subfinder/goaltdns
Note - You need to copy the words.txt file into the same directory as the tool or specify it's location via the -w flag.
If you wish to upgrade the package you can use:
go get -u github.com/subfinder/goaltdns
GoAltdns can read hosts directly from standard input, or either take a single host as argument, or a list of hosts. To provide a single host, you can use the
-h option. In order to provide a list of hosts, you can use the
[email protected]:~/tmp/goaltdns$ ./altdns -host phabricator.freelancer.com 1phabricator.freelancer.com phabricator1.freelancer.com 10phabricator.freelancer.com 1-phabricator.freelancer.com phabricator10.freelancer.com phabricator-0.freelancer.com 1.phabricator.freelancer.com ...
Sample run reading from stdin:
[email protected]:~/tmp/goaltdns$ echo phabricator.freelancer.com | ./altdns 1phabricator.freelancer.com phabricator1.freelancer.com 10phabricator.freelancer.com 1-phabricator.freelancer.com phabricator10.freelancer.com phabricator-0.freelancer.com 1.phabricator.freelancer.com ...
You can pass custom wordlists using the -w option. Currently, it uses words.txt taken from here.
By default, goaltdns writes to the standard output. If you want to save the results to a file, you can use
-o flag with the name of then file to write to it.
[email protected]:~/tmp/goaltdns$ ./altdns -l ~/uberinternal -o output.txt
This will render a blank console but the tool will still write to the output file.
GoAltdns is made with 🖤 by Subfinder team.
See the License file for more details.