How it works
Subdomain enumeration starts with a wordlist, and generic million-line lists waste most of your resolver traffic on hosts that will never exist for your target. A generated list tuned to the target's vocabulary — its product names, environments and naming habits — finds more with a fraction of the queries. This generator builds that list locally: base words, environment prefixes and suffixes, structural patterns and numeric ranges.
Four patterns compose the output: bare base words (api), environment-base (dev-api), base-environment (api-staging) and numbered variants (api1…api99). Environment checkboxes cover the names teams actually use — dev, staging, stage, test, uat, beta, internal, old, backup — because forgotten pre-production hosts are where the interesting exposures live: debug flags, verbose errors, default credentials, unpatched frameworks.
The result is deduplicated, sorted and countable, ready to copy or download as a .txt for your resolver of choice. Generation is entirely local — the tool makes no DNS requests and touches nothing on the network, so the wordlist phase of recon leaves no trace anywhere.
Authorized use. Enumerate your own infrastructure or scopes you have written permission to test. For defense, the same list is an inventory audit: every public hostname should be intentional, documented and patched — the generator shows you exactly which names an auditor will try first.
Worked example
Generate a focused list for a SaaS target: base words api, admin, dashboard, environments dev and staging, all four patterns, numbers 1–9.
| Pattern | Example entries | Why it exists |
|---|---|---|
| base | api, admin, dashboard | Production naming habits. |
| env-base | dev-api, staging-admin | Pre-production hosts with weaker controls. |
| base-env | api-dev, dashboard-staging | The reversed convention many teams use. |
| basenum | api1 … api9 | Horizontal scaling and legacy migrations. |
- Seed the base words: Start with product and infrastructure vocabulary; comma-separated.
- Pick environments: dev, staging, test and old find the forgotten hosts.
- Choose patterns: env-base, base-env and numbered variants cover naming conventions.
- Copy or download: Take the list to your resolver, filter wildcards, recurse on findings.
Three base words with two environments and numbers 1–9 produce about 50 focused entries instead of thousands of generic guesses — resolvable in seconds and far more likely to hit.
Common errors and edge cases
- Generating before researching. Read the target's certificates, docs and job posts first; their real vocabulary beats any default list. Feed discovered words back in as base words.
- Wildcard DNS false positives. Many zones answer every name. Detect the wildcard IP first and filter it, or your results are noise.
- Forgetting permutations of found hosts. Every discovered subdomain is a new base word — dev-api implies dev-api-01 and staging-dev-api may exist. Recurse one level.
- Ignoring passive sources. Certificate Transparency logs often out-perform brute force entirely. Combine generated lists with crt.sh output before resolving anything.
- Defense blind spot. If the generator guesses it, auditors find it. Decommission or protect forgotten dev, old and backup hosts — they are the favorite entry point.
Code equivalents
Feed the generated list to standard resolvers, and check Certificate Transparency before brute-forcing anything.
| Tool | Usage |
|---|---|
| puredns | puredns resolve wordlist.txt -r resolvers.txt — fast mass resolution with wildcard filtering. |
| crt.sh (passive) | curl -s 'https://crt.sh/?q=%25.yourdomain.com&output=json' — certificate logs reveal real hosts for free. |
| Defense audit | Resolve the list against your own zone quarterly; every live answer must be intentional and patched. |
Related tools
Frequently asked questions
Why generate a wordlist instead of using a public one?
Public lists are noise for a specific target. A list built from the target's own vocabulary and naming conventions finds more real hosts with a fraction of the DNS traffic and time.
What base words work best?
Product names, team names, and infrastructure nouns from the target's own docs, certificates and job postings. Start with the defaults here, then feed in everything recon discovers.
How do I handle wildcard DNS?
Resolve a few random nonsense names first; if they all answer, that is your wildcard. Filter every subsequent result matching those IPs, or use puredns which does it automatically.
Is subdomain enumeration legal?
On your own infrastructure or authorized scopes, yes. Enumeration is reconnaissance; testing what you find without authorization is where legality ends.
What should I do with the results defensively?
Diff the live answers against your asset inventory. Every undocumented host gets a ticket: decommission it, or bring it under the same patching, authentication and monitoring as production.
Privacy note
All processing happens in your browser. The values you enter never leave your device and are never transmitted to ToolPlex.