Gotator is a tool to generate DNS wordlists through permutations.

?️ Installation

If you want to make modifications locally and compile it, follow the instructions below:

> git clone
> cd gotator
> go build

If you are only interested in using the program:

> go get

? Docker option:

> git clone
> cd gotator
> docker build -t gotator . 
# Usage 
> docker run gotator -sub subdomains.txt  [...]

Note If you are using version 1.16 or higher and you have any errors, run the following command:

> go env -w GO111MODULE="auto"

To upgrade the version add the -u parameter to the installation command.

✨ Features

Gotator has the following features for permutation:

  • Checks domain and TLD analyzing ccSLDs to avoid going out of scope (,, etc.).
  • Permute numbers up and down [-numbers <uint>], for example:
    • Target subdomain is 10 and numbers flag is set to 3 [-numbers 3], as a result we will have between 7 and 13.
    • Target subdomain is dev1 and numbers flag is set to 3 [-numbers 3], we will see dev0, dev1, dev2, dev3, and dev4 (avoiding negative numbers).
  • Gotator has 3 levels of depth [-depth <uint>]:
    • If depth is set to 1 (default mode), to permute test word on, we will get With this option if subdomain target is and permutation is test we also interchange the position for the permutation "-" and "", obtaining results such as and (check example 1).
    • If depth is set to 2, and we have to permute dev and demo on, we will obtain or apart from and Depth level 3 is an extension of this example.
  • Control and reduce duplicates (due to the high number of lines generated, the objective here is to reduce as much as possible the domains with almost null possibilities to exist):
    • If we have and the next permutation will be test again, it is ignored.
    • If we have and test comes up, when matching test it will be joined with . and -, avoiding
    • If we have and it gets 90 to permute, the permutation is ignored as it already has a number permutation feature.
    • If we have and it gets test to permute, we remove numbers and test==test so the permutation is ignored as it already has something very similar.
  • For the subdomains within the target, for example, we get the value demo210 and add it to the permutations list.
  • Mode to "swap" domains, i.e. if the target is, it will be added as target and [-md].
  • Option to add default permutations list defined in gotator [-prefixes].
  • Only the results are written to the standard output. Banner and messages are sent to the error output. So you can pipe the command.

? Options

The flags that can be used to launch the tool:

Flag Type Mandatory Description Example
sub string yes List of domains to be swapped. -sub subdomains.txt
perm string no List of permutations. -perm permutations.txt
depth uint no Configure the depth (Between 1 and 3) - Default 1. -depth 2
numbers uint no Configure the number of iterations to the numbers found in the permutations (up and down). Default 0 Skip!. -numbers 10
prefixes bool no Adding default gotator prefixes to permutations. If not configured perm is used by default. If perm is specified with this flag you merge the permutations. -prefixes
md bool no Extract 'previous' domains and subdomains from subdomains found in the list 'sub'. -md
silent bool no Gotator banner is not displayed. -silent

? Usage

gotator -sub domains.txt -perm permutations.txt -depth 2 -numbers 5 > output.txt

To filter the result and remove possible duplicates:

gotator -sub domains.txt -perm permutations.txt -depth 3 -numbers 10 -md | uniq > output2.txt

Change uniq to sort -u of the previous command if you want to sort them. (Not recommended due to time)

Note: If you are compiling locally don't forget the ./ in front of your binary!

? Examples

We have the following lists:


In the first example we mutate on the specified subdomain


In the following example we instruct Gotator to extract possible domains from the subdomains with -md:


You can see that is taken into account. Now an example with a list of permutations containing test100demo and we give it the argument -numbers 3:


Finally, it is possible to see a greater mutation depth and also specify the prefixes parameter (which adds a small mutation list).


The last example shows only part of the output.

? Disclaimer

This tool can generate huge size files and some duplicates, we encourage to filter the output with uniq or sort -u and take care of depth flag due to the size output (it's easy to generate files > 10 GB). Keep in mind piped output to other tools requires the tool processing the whole output at once (sort, uniq).

  • Examples:
# Filter output by size
gotator -sub subs.txt -perm perm.txt -depth 2 -numbers 5 -md | head -c 1G > output1G.txt

# Filter output by lines
gotator -sub subs.txt -perm perm.txt -depth 3 -numbers 20 | head -n 100000 > output100Klines.txt

# Sort unique lines
gotator -sub subs.txt -perm perm.txt -depth 2 -numbers 10 -prefixes | sort -u > outputSortUnique.txt

# Unique lines 
gotator -sub subs.txt -perm perm.txt -depth 3 | uniq > outputUnique.txt

# Sort unique with limit size
gotator -sub subs.txt -perm perm.txt -prefixes | head -c 1G | sort -u > output1GSortedUnique.txt