altdns

Overview

altdns generates and resolves DNS permutations from a list of known subdomains. Given api.example.com, it generates variants like dev-api.example.com, api.staging.example.com, api2.example.com, etc. — often discovering hosts that pattern-only enumeration misses.

Installation

pip3 install py-altdns
# Or
git clone https://github.com/infosec-au/altdns
cd altdns
pip3 install -r requirements.txt

Basic Usage

Generate permutations and save to file (no resolution)

altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt

Generate AND resolve permutations

altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt -r -s resolved.txt

With DNS resolver

altdns -i subs.txt -o perms.txt -w words.txt -r -s resolved.txt -d 8.8.8.8

Input Files

known_subdomains.txt — discovered subdomains (from amass, subfinder, etc.)

cat > known_subdomains.txt << 'EOF'
api.example.com
dev.example.com
mail.example.com
vpn.example.com
EOF

# Altdns word list (mutations to apply)
# Default included in the package
# /path/to/altdns/words.txt

Or use custom word list:

cat > mutations.txt << 'EOF'
dev
staging
test
prod
internal
admin
backup
old
new
2
EOF

Workflow Integration

# Step 1: Passive subdomain discovery
subfinder -d example.com -silent > known_subs.txt
amass enum -passive -d example.com >> known_subs.txt
sort -u known_subs.txt > known_subs_deduped.txt

Step 2: Generate permutations with altdns

altdns -i known_subs_deduped.txt \
       -o permutations.txt \
       -w /usr/share/altdns/words.txt \
       -r \
       -s resolved_new.txt

Step 3: Combine results

cat known_subs_deduped.txt resolved_new.txt | sort -u > all_subdomains.txt

Step 4: Probe with httpx

cat all_subdomains.txt | httpx -silent > live_web.txt

Custom Word Lists

Good permutation words for common environments

cat > mutations.txt << 'EOF'
dev
development
staging
stage
stg
prod
production
uat
qa
test
testing
beta
alpha
internal
intranet
admin
api
v1
v2
v3
new
old
backup
b
2
EOF

Tips

• altdns is most effective after initial passive discovery — you need known subdomains as seed
• Combine with massdns for fast bulk resolution of generated permutations
• Use puredns as a wrapper for better wildcard DNS handling
• Common discoveries: dev variants of production services, forgotten staging environments

altdns [options]

-i FILE       Input file with known subdomains
-o FILE       Output file for permutations (unresolved)
-w FILE       Word list for permutations
-r            Resolve generated permutations
-s FILE       Save resolved domains to file
-d DNS        DNS resolver to use (default: system resolver)
-t THREADS    Threads for resolution (default: 100)

Vue d’ensemble

altdns génère et résout des permutations DNS à partir d’une liste de sous-domaines connus. À partir d’api.example.com, il génère des variantes comme dev-api.example.com, api.staging.example.com, api2.example.com, etc. Il découvre souvent des hôtes que l’énumération par motif seul rate.

Installation

pip3 install py-altdns
# Ou
git clone https://github.com/infosec-au/altdns
cd altdns
pip3 install -r requirements.txt

Utilisation de base

# Générer les permutations et sauvegarder dans un fichier (sans résolution)
altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt

# Générer ET résoudre les permutations
altdns -i known_subdomains.txt -o permutations.txt -w altdns_words.txt -r -s resolved.txt

# Avec un resolver DNS
altdns -i subs.txt -o perms.txt -w words.txt -r -s resolved.txt -d 8.8.8.8

Fichiers d’entrée

# known_subdomains.txt : sous-domaines découverts (via amass, subfinder, etc.)
cat > known_subdomains.txt << 'EOF'
api.example.com
dev.example.com
mail.example.com
vpn.example.com
EOF

# Liste de mots altdns (mutations à appliquer)
# Incluse par défaut dans le paquet
# /path/to/altdns/words.txt

Ou utiliser une liste de mots personnalisée :

cat > mutations.txt << 'EOF'
dev
staging
test
prod
internal
admin
backup
old
new
2
EOF

Intégration dans un workflow

# Étape 1 : découverte passive de sous-domaines
subfinder -d example.com -silent > known_subs.txt
amass enum -passive -d example.com >> known_subs.txt
sort -u known_subs.txt > known_subs_deduped.txt

# Étape 2 : générer les permutations avec altdns
altdns -i known_subs_deduped.txt \
       -o permutations.txt \
       -w /usr/share/altdns/words.txt \
       -r \
       -s resolved_new.txt

# Étape 3 : combiner les résultats
cat known_subs_deduped.txt resolved_new.txt | sort -u > all_subdomains.txt

# Étape 4 : sonder avec httpx
cat all_subdomains.txt | httpx -silent > live_web.txt

Listes de mots personnalisées

# Bons mots de permutation pour les environnements courants
cat > mutations.txt << 'EOF'
dev
development
staging
stage
stg
prod
production
uat
qa
test
testing
beta
alpha
internal
intranet
admin
api
v1
v2
v3
new
old
backup
b
2
EOF

Conseils

• altdns est le plus efficace après une découverte passive initiale : il vous faut des sous-domaines connus comme point de départ
• Combinez avec massdns pour une résolution en masse rapide des permutations générées
• Utilisez puredns comme wrapper pour une meilleure gestion du DNS wildcard
• Découvertes courantes : variantes dev de services de production, environnements de staging oubliés

altdns [options]

-i FILE       Input file with known subdomains
-o FILE       Output file for permutations (unresolved)
-w FILE       Word list for permutations
-r            Resolve generated permutations
-s FILE       Save resolved domains to file
-d DNS        DNS resolver to use (default: system resolver)
-t THREADS    Threads for resolution (default: 100)