{"id":13702021,"url":"https://github.com/projectdiscovery/alterx","last_synced_at":"2025-05-14T15:06:27.963Z","repository":{"id":150453807,"uuid":"616826955","full_name":"projectdiscovery/alterx","owner":"projectdiscovery","description":"Fast and customizable subdomain wordlist generator using DSL","archived":false,"fork":false,"pushed_at":"2025-04-16T22:57:35.000Z","size":636,"stargazers_count":807,"open_issues_count":10,"forks_count":65,"subscribers_count":12,"default_branch":"main","last_synced_at":"2025-05-08T00:45:54.607Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/projectdiscovery.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-03-21T06:54:10.000Z","updated_at":"2025-05-06T13:20:05.000Z","dependencies_parsed_at":"2023-10-16T18:33:50.121Z","dependency_job_id":"6d6d33d9-1378-4e87-88e6-093685967141","html_url":"https://github.com/projectdiscovery/alterx","commit_stats":{"total_commits":190,"total_committers":8,"mean_commits":23.75,"dds":0.0736842105263158,"last_synced_commit":"03203927879a28a841d326adeace9f6e97bea3a8"},"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectdiscovery%2Falterx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectdiscovery%2Falterx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectdiscovery%2Falterx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/projectdiscovery%2Falterx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/projectdiscovery","download_url":"https://codeload.github.com/projectdiscovery/alterx/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254169062,"owners_count":22026208,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T21:00:29.829Z","updated_at":"2025-05-14T15:06:27.926Z","avatar_url":"https://github.com/projectdiscovery.png","language":"Go","readme":"\u003ch1 align=\"center\"\u003e\n AlterX\n\u003cbr\u003e\n\u003c/h1\u003e\n\n\n\u003cp align=\"center\"\u003e\n\u003ca href=\"https://opensource.org/licenses/MIT\"\u003e\u003cimg src=\"https://img.shields.io/badge/license-MIT-_red.svg\"\u003e\u003c/a\u003e\n\u003ca href=\"https://goreportcard.com/badge/github.com/projectdiscovery/alterx\"\u003e\u003cimg src=\"https://goreportcard.com/badge/github.com/projectdiscovery/alterx\"\u003e\u003c/a\u003e\n\u003ca href=\"https://pkg.go.dev/github.com/projectdiscovery/alterx/pkg/alterx\"\u003e\u003cimg src=\"https://img.shields.io/badge/go-reference-blue\"\u003e\u003c/a\u003e\n\u003ca href=\"https://github.com/projectdiscovery/alterx/releases\"\u003e\u003cimg src=\"https://img.shields.io/github/release/projectdiscovery/alterx\"\u003e\u003c/a\u003e\n\u003ca href=\"https://twitter.com/pdiscoveryio\"\u003e\u003cimg src=\"https://img.shields.io/twitter/follow/pdiscoveryio.svg?logo=twitter\"\u003e\u003c/a\u003e\n\u003ca href=\"https://discord.gg/projectdiscovery\"\u003e\u003cimg src=\"https://img.shields.io/discord/695645237418131507.svg?logo=discord\"\u003e\u003c/a\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"#features\"\u003eFeatures\u003c/a\u003e •\n  \u003ca href=\"#installation\"\u003eInstallation\u003c/a\u003e •\n  \u003ca href=\"#help-menu\"\u003eUsage\u003c/a\u003e •\n  \u003ca href=\"#examples\"\u003eRunning AlterX\u003c/a\u003e •\n  \u003ca href=\"https://discord.gg/projectdiscovery\"\u003eJoin Discord\u003c/a\u003e\n\n\u003c/p\u003e\n\n\u003cpre align=\"center\"\u003e\n\u003cb\u003e\n   Fast and customizable subdomain wordlist generator using DSL.\n\u003c/b\u003e\n\u003c/pre\u003e\n\n![image](https://user-images.githubusercontent.com/8293321/229380735-140d3f25-d0cb-461d-8c49-4c1eff43d1f4.png)\n\n## Features\n- Fast and Customizable\n- **Automatic word enrichment**\n- Pre-defined variables\n- **Configurable Patterns**\n- STDIN / List input\n\n## Installation\nTo install alterx, you need to have Golang 1.19 installed on your system. You can download Golang from [here](https://go.dev/doc/install). After installing Golang, you can use the following command to install alterx:\n\n\n```bash\ngo install github.com/projectdiscovery/alterx/cmd/alterx@latest\n```\n\n## Help Menu\nYou can use the following command to see the available flags and options:\n\n```console\nFast and customizable subdomain wordlist generator using DSL.\n\nUsage:\n  ./alterx [flags]\n\nFlags:\nINPUT:\n   -l, -list string[]     subdomains to use when creating permutations (stdin, comma-separated, file)\n   -p, -pattern string[]  custom permutation patterns input to generate (comma-seperated, file)\n   -pp, -payload value    custom payload pattern input to replace/use in key=value format (-pp 'word=words.txt')\n\nOUTPUT:\n   -es, -estimate      estimate permutation count without generating payloads\n   -o, -output string  output file to write altered subdomain list\n   -ms, -max-size int  Max export data size (kb, mb, gb, tb) (default mb)\n   -v, -verbose        display verbose output\n   -silent             display results only\n   -version            display alterx version\n\nCONFIG:\n   -config string  alterx cli config file (default '$HOME/.config/alterx/config.yaml')\n   -en, -enrich    enrich wordlist by extracting words from input\n   -ac string      alterx permutation config file (default '$HOME/.config/alterx/permutation_v0.0.1.yaml')\n   -limit int      limit the number of results to return (default 0)\n\nUPDATE:\n   -up, -update                 update alterx to latest version\n   -duc, -disable-update-check  disable automatic alterx update check\n```\n\n## Why `alterx` ??\n\nwhat makes `alterx` different from any other subdomain permutation tools like `goaltdns` is its `scripting` feature . alterx takes patterns as input and generates subdomain permutation wordlist based on that pattern similar to what [nuclei](https://github.com/projectdiscovery/nuclei) does with [fuzzing-templates](https://github.com/projectdiscovery/fuzzing-templates) .\n\nWhat makes `Active Subdomain Enumeration` difficult is the probability of finding a domain that actually exists. If finding possible subdomains is represented on a scale it should look something like\n\n```console\n   Using Wordlist \u003c generate permutations with subdomains (goaltdns) \u003c alterx\n```\n\nAlmost all popular subdomain permutation tools have hardcoded patterns and when such tools are run they create wordlist which contain subdomains in Millions and this decreases the feasibility of bruteforcing them with tools like dnsx . There is no actual convention to name subdomains and usually depends on person registering the subdomain. with `alterx` it is possible to create patterns based on results from `passive subdomain enumeration` results which increases probability of finding a subdomain and feasibility to bruteforce them.\n\n## Variables\n\n`alterx` uses variable-like syntax similar to nuclei-templates. One can write their own patterns using these variables . when domains are passed as input `alterx` evaluates input and extracts variables from it .\n\n### Basic / Common Variables\n\n```yaml\n{{sub}}     :  subdomain prefix or left most part of a subdomain\n{{suffix}}  :  everything except {{sub}} in subdomain name is suffix\n{{tld}}     :  top level domain name (ex com,uk,in etc)\n{{etld}}    :  also know as public suffix (ex co.uk , gov.in etc)\n```\n\n| Variable   | api.scanme.sh | admin.dev.scanme.sh | cloud.scanme.co.uk |\n| ---------- | ------------- | ------------------- | ------------------ |\n| `{{sub}}`    | `api`         | `admin`             | `cloud`          |\n| `{{suffix}}` | `scanme.sh`   | `dev.scanme.sh`     | `scanme.co.uk`   |\n| `{{tld}}`    | `sh`          | `sh`                | `uk`             |\n| `{{etld}}`   | `-`           | `-`                 | `co.uk`          |\n\n### Advanced Variables\n\n```yaml\n{{sld}}  :   second-level domain  (ex for api.scanme.sh =\u003e {{sld}} is scanme)\n{{root}}  :  also known as eTLD+1 i.e only root domain (ex for api.scanme.sh =\u003e {{root}} is scanme.sh)\n{{subN}}  :  here N is an integer (ex {{sub1}} , {{sub2}} etc) .\n\n// {{subN}} is advanced variable which exists depending on input\n// lets say there is a multi level domain cloud.nuclei.scanme.sh\n// in this case {{sub}} = cloud and {{sub1}} = nuclei`\n```\n\n| Variable | api.scanme.sh | admin.dev.scanme.sh | cloud.scanme.co.uk |\n| -------- | ------------- | ------------------- | ------------------ |\n| `{{sld}}` | `scanme`      | `scanme`            | `scanme`         |\n| `{{root}}` | `scanme.sh`   | `scanme.sh`         | `scanme.co.uk`   |\n| `{{sub1}}` | `-`           | `dev`               | `-`              |\n| `{{sub2}}` | `-`           | `-`                 | `-`              |\n\n\n## Patterns\n\npattern in simple terms can be considered as `template` that describes what type of patterns should alterx generate.\n\n```console\n// Below are some of example patterns which can be used to generate permutations\n// assuming api.scanme.sh was given as input and variable {{word}} was given as input with only one value prod\n// alterx generates subdomains for below patterns\n\n\"{{sub}}-{{word}}.{{suffix}}\" // ex: api-prod.scanme.sh\n\"{{word}}-{{sub}}.{{suffix}}\" // ex: prod-api.scanme.sh\n\"{{word}}.{{sub}}.{{suffix}}\" // ex: prod.api.scanme.sh\n\"{{sub}}.{{word}}.{{suffix}}\" // ex: api.prod.scanme.sh\n```\n\nHere is an example pattern config file - https://github.com/projectdiscovery/alterx/blob/main/permutations.yaml that can be easily customizable as per need.\n\nThis configuration file generates subdomain permutations for security assessments or penetration tests using customizable patterns and dynamic payloads. Patterns include dash-based, dot-based, and others. Users can create custom payload sections, such as words, region identifiers, or numbers, to suit their specific needs.\n\nFor example, a user could define a new payload section `env` with values like `prod` and `dev`, then use it in patterns like `{{env}}-{{word}}.{{suffix}}` to generate subdomains like `prod-app.example.com` and `dev-api.example.com`. This flexibility allows tailored subdomain list for unique testing scenarios and target environments.\n\nDefault pattern config file used for generation is stored in `$HOME/.config/alterx/` directory, and custom config file can be also used using `-ac` option.\n\n## Examples\n\nAn example of running alterx on existing list of passive subdomains of `tesla.com` yield us **10 additional NEW** and **valid subdomains** resolved using [dnsx](https://github.com/projectdiscovery/dnsx).\n\n```console\n$ chaos -d tesla.com | alterx | dnsx\n\n\n\n   ___   ____          _  __\n  / _ | / / /____ ____| |/_/\n / __ |/ / __/ -_) __/\u003e  \u003c\n/_/ |_/_/\\__/\\__/_/ /_/|_|\n\n      projectdiscovery.io\n\n[INF] Generated 8312 permutations in 0.0740s\nauth-global-stage.tesla.com\nauth-stage.tesla.com\ndigitalassets-stage.tesla.com\nerrlog-stage.tesla.com\nkronos-dev.tesla.com\nmfa-stage.tesla.com\npaymentrecon-stage.tesla.com\nsso-dev.tesla.com\nshop-stage.tesla.com\nwww-uat-dev.tesla.com\n```\n\nSimilarly `-enrich` option can be used to populate known subdomains as world input to generate **target aware permutations**.\n\n```console\n$ chaos -d tesla.com | alterx -enrich\n\n   ___   ____          _  __\n  / _ | / / /____ ____| |/_/\n / __ |/ / __/ -_) __/\u003e  \u003c\n/_/ |_/_/\\__/\\__/_/ /_/|_|\n\n      projectdiscovery.io\n\n[INF] Generated 662010 permutations in 3.9989s\n```\n\nYou can alter the default patterns at run time using `-pattern` CLI option.\n\n```console\n$ chaos -d tesla.com | alterx -enrich -p '{{word}}-{{suffix}}'\n\n   ___   ____          _  __\n  / _ | / / /____ ____| |/_/\n / __ |/ / __/ -_) __/\u003e  \u003c\n/_/ |_/_/\\__/\\__/_/ /_/|_|\n\n      projectdiscovery.io\n\n[INF] Generated 21523 permutations in 0.7984s\n```\n\nIt is also possible to overwrite existing variables value using `-payload` CLI options.\n\n```console\n$ alterx -list tesla.txt -enrich -p '{{word}}-{{year}}.{{suffix}}' -pp word=keywords.txt -pp year=2023\n\n   ___   ____          _  __\n  / _ | / / /____ ____| |/_/\n / __ |/ / __/ -_) __/\u003e  \u003c\n/_/ |_/_/\\__/\\__/_/ /_/|_|\n\n      projectdiscovery.io\n\n[INF] Generated 21419 permutations in 1.1699s\n```\n\n**For more information, please checkout the release blog** - https://blog.projectdiscovery.io/introducing-alterx-simplifying-active-subdomain-enumeration-with-patterns/\n\n\nDo also check out the below similar open-source projects that may fit in your workflow:\n\n[altdns](https://github.com/infosec-au/altdns), [goaltdns](https://github.com/subfinder/goaltdns), [gotator](https://github.com/Josue87/gotator), [ripgen](https://github.com/resyncgg/ripgen/), [dnsgen](https://github.com/ProjectAnte/dnsgen), [dmut](https://github.com/bp0lr/dmut), [permdns](https://github.com/hpy/permDNS), [str-replace](https://github.com/j3ssie/str-replace), [dnscewl](https://github.com/codingo/DNSCewl), [regulator](https://github.com/cramppet/regulator)\n\n\n--------\n\n\u003cdiv align=\"center\"\u003e\n\n**alterx** is made with ❤️ by the [projectdiscovery](https://projectdiscovery.io) team and distributed under [MIT License](LICENSE.md).\n\n\n\u003ca href=\"https://discord.gg/projectdiscovery\"\u003e\u003cimg src=\"https://raw.githubusercontent.com/projectdiscovery/nuclei-burp-plugin/main/static/join-discord.png\" width=\"300\" alt=\"Join Discord\"\u003e\u003c/a\u003e\n\n\u003c/div\u003e\n","funding_links":[],"categories":["Miscellaneous","[](#table-of-contents) Table of contents","[↑](#-table-of-contents) SubDomain's","Weapons","扫描字典"],"sub_categories":["Permutation","[](#subdomains-scanbrute)Subdomains scan/brute","Tools"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprojectdiscovery%2Falterx","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprojectdiscovery%2Falterx","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprojectdiscovery%2Falterx/lists"}