← retour aux outils back to tools

# altdns

Moteur de permutation DNS pour la découverte de sous-domaines. Prend une liste de sous-domaines connus et génère des permutations (variantes dev, staging, api), puis les résout pour trouver de nouveaux hôtes. DNS permutation engine for subdomain discovery. Takes a list of known subdomains and generates permutations (dev, staging, api variants), then resolves them to find new hosts.

↗ https://github.com/infosec-au/altdns

## Overview

altdns generates and resolves DNS permutations from a list of known subdomains. Given `api.example.com`, it generates variants like `dev-api.example.com`, `api.staging.example.com`, `api2.example.com`, etc. — often discovering hosts that pattern-only enumeration misses.

## Installation

    pip3 install py-altdns
    # Or
    git clone https://github.com/infosec-au/altdns
    cd altdns
    pip3 install -r requirements.txt

## Basic Usage

Generate permutations and save to file (no resolution)

    altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt

Generate AND resolve permutations

    altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt -r -s resolved.txt

With DNS resolver

    altdns -i subs.txt -o perms.txt -w words.txt -r -s resolved.txt -d 8.8.8.8

## Input Files

known_subdomains.txt — discovered subdomains (from amass, subfinder, etc.)

    cat > known_subdomains.txt << 'EOF'
    api.example.com
    dev.example.com
    mail.example.com
    vpn.example.com
    EOF

    # Altdns word list (mutations to apply)
    # Default included in the package
    # /path/to/altdns/words.txt

Or use custom word list:

    cat > mutations.txt << 'EOF'
    dev
    staging
    test
    prod
    internal
    admin
    backup
    old
    new
    2
    EOF

## Workflow Integration

    # Step 1: Passive subdomain discovery
    subfinder -d example.com -silent > known_subs.txt
    amass enum -passive -d example.com >> known_subs.txt
    sort -u known_subs.txt > known_subs_deduped.txt

Step 2: Generate permutations with altdns

    altdns -i known_subs_deduped.txt \
           -o permutations.txt \
           -w /usr/share/altdns/words.txt \
           -r \
           -s resolved_new.txt

Step 3: Combine results

    cat known_subs_deduped.txt resolved_new.txt | sort -u > all_subdomains.txt

Step 4: Probe with httpx

    cat all_subdomains.txt | httpx -silent > live_web.txt

## Custom Word Lists

Good permutation words for common environments

    cat > mutations.txt << 'EOF'
    dev
    development
    staging
    stage
    stg
    prod
    production
    uat
    qa
    test
    testing
    beta
    alpha
    internal
    intranet
    admin
    api
    v1
    v2
    v3
    new
    old
    backup
    b
    2
    EOF

## Tips

- altdns is most effective after initial passive discovery — you need known subdomains as seed
- Combine with massdns for fast bulk resolution of generated permutations
- Use `puredns` as a wrapper for better wildcard DNS handling
- Common discoveries: dev variants of production services, forgotten staging environments

Help / Man page

    altdns [options]

    -i FILE       Input file with known subdomains
    -o FILE       Output file for permutations (unresolved)
    -w FILE       Word list for permutations
    -r            Resolve generated permutations
    -s FILE       Save resolved domains to file
    -d DNS        DNS resolver to use (default: system resolver)
    -t THREADS    Threads for resolution (default: 100)

## Vue d’ensemble

altdns génère et résout des permutations DNS à partir d’une liste de sous-domaines connus. À partir d’`api.example.com`, il génère des variantes comme `dev-api.example.com`, `api.staging.example.com`, `api2.example.com`, etc. Il découvre souvent des hôtes que l’énumération par motif seul rate.

## Installation

    pip3 install py-altdns
    # Ou
    git clone https://github.com/infosec-au/altdns
    cd altdns
    pip3 install -r requirements.txt

## Utilisation de base

    # Générer les permutations et sauvegarder dans un fichier (sans résolution)
    altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt

    # Générer ET résoudre les permutations
    altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt -r -s resolved.txt

    # Avec un resolver DNS
    altdns -i subs.txt -o perms.txt -w words.txt -r -s resolved.txt -d 8.8.8.8

## Fichiers d’entrée

    # known_subdomains.txt : sous-domaines découverts (via amass, subfinder, etc.)
    cat > known_subdomains.txt << 'EOF'
    api.example.com
    dev.example.com
    mail.example.com
    vpn.example.com
    EOF

    # Liste de mots altdns (mutations à appliquer)
    # Incluse par défaut dans le paquet
    # /path/to/altdns/words.txt

Ou utiliser une liste de mots personnalisée :

    cat > mutations.txt << 'EOF'
    dev
    staging
    test
    prod
    internal
    admin
    backup
    old
    new
    2
    EOF

## Intégration dans un workflow

    # Étape 1 : découverte passive de sous-domaines
    subfinder -d example.com -silent > known_subs.txt
    amass enum -passive -d example.com >> known_subs.txt
    sort -u known_subs.txt > known_subs_deduped.txt

    # Étape 2 : générer les permutations avec altdns
    altdns -i known_subs_deduped.txt \
           -o permutations.txt \
           -w /usr/share/altdns/words.txt \
           -r \
           -s resolved_new.txt

    # Étape 3 : combiner les résultats
    cat known_subs_deduped.txt resolved_new.txt | sort -u > all_subdomains.txt

    # Étape 4 : sonder avec httpx
    cat all_subdomains.txt | httpx -silent > live_web.txt

## Listes de mots personnalisées

    # Bons mots de permutation pour les environnements courants
    cat > mutations.txt << 'EOF'
    dev
    development
    staging
    stage
    stg
    prod
    production
    uat
    qa
    test
    testing
    beta
    alpha
    internal
    intranet
    admin
    api
    v1
    v2
    v3
    new
    old
    backup
    b
    2
    EOF

## Conseils

- altdns est le plus efficace après une découverte passive initiale : il vous faut des sous-domaines connus comme point de départ
- Combinez avec massdns pour une résolution en masse rapide des permutations générées
- Utilisez `puredns` comme wrapper pour une meilleure gestion du DNS wildcard
- Découvertes courantes : variantes dev de services de production, environnements de staging oubliés

Aide / Page de manuel

    altdns [options]

    -i FILE       Input file with known subdomains
    -o FILE       Output file for permutations (unresolved)
    -w FILE       Word list for permutations
    -r            Resolve generated permutations
    -s FILE       Save resolved domains to file
    -d DNS        DNS resolver to use (default: system resolver)
    -t THREADS    Threads for resolution (default: 100)