During the reconnaissance phase of security testing, discovering secondary, staging, and administrative subdomains is critical for uncovering vulnerable applications. While passive DNS databases catalogue known domain names, organisations frequently deploy new environments matching predictable corporate naming conventions (such as dev-api, stage-auth, or eu-west-db). AlterX, created by ProjectDiscovery, is a high-speed permutation tool that infers naming patterns from seed subdomains and synthesises bespoke wordlists for active DNS resolution.
Installation Procedures
AlterX is written in Go and can be deployed rapidly across Linux platforms:
| Installation Route | Shell Execution Command | Environment Target |
|---|---|---|
| Go Install | go install github.com/projectdiscovery/alterx/cmd/alterx@latest |
Workstations with Go 1.21+ installed. |
| Precompiled Binary | curl -sL https://github.com/projectdiscovery/alterx/releases/latest/download/alterx_linux_amd64.zip -o alterx.zip && unzip alterx.zip && sudo mv alterx /usr/local/bin/ |
Minimal cloud instances and CI/CD pipelines. |
| Pdtm Package Tool | pdtm -i alterx |
Centrally managed ProjectDiscovery toolkits. |
Basic and Pattern-Based Permutations
- Generating Default Permutations: Pass a single domain to AlterX to generate pattern mutations based on standard word substitutions:
AlterX automatically splits prefixes, numbers, and hyphens, producing mutations such asecho "api.example.com" | alterxapi-dev.example.com,api-v1.example.com, andapi-stage.example.com. - Custom Pattern Enforcement: Define custom generation patterns using syntax templates. For instance, to test cloud region and environment patterns:
This generates strictly targeted permutations without unnecessary wordlist bloat.echo "api.example.com" | alterx -pattern '{{sub}}-{{word}}.{{root}}' -payload 'word=dev,test,prod,uat' - Feeding Seed Lists from Reconnaissance Tools: Pipe output directly from passive subdomain discovery tools like
subfinderinto AlterX:subfinder -d example.com -silent | alterx -o permutations.txt
Chaining AlterX into High-Speed DNS Resolvers
Generating wordlists is only the first phase; those permutations must be actively resolved to verify whether live DNS records exist. Chain AlterX output directly into puredns or ProjectDiscovery’s dnsx:
subfinder -d example.com -silent | alterx | dnsx -silent -a -resp -o resolved_domains.txtConfiguring Custom Payload Dictionaries
To align AlterX permutations with industry-specific infrastructure jargon, customise its base dictionary at ~/.config/alterx/words.txt. Adding regional codes (lon, fra, syd) or internal service monikers ensures generated wordlists match your organisation’s exact deployment naming conventions.