AlterX Subdomain Wordlist Generator Cheat Sheet¶

Überblick¶

AlterX ist ein schneller und anpassbarer Subdomain-Wordlist-Generator, entwickelt von Project Discovery. Er verwendet Muster und domänenspezifische Sprache (DSL), um Permutationen und Alterationen von Subdomains zu generieren, was ihn zu einem leistungsstarken Werkzeug für aktive Subdomain-Enumeration macht. AlterX passt in die Pipeline der aktiven Subdomain-Enumeration und ergänzt passive Subdomain-Erkennungstools wie Subfinder.

Was AlterX von anderen Wordlist-Generatoren unterscheidet, ist sein musterbasierter Ansatz und seine Fähigkeit, zielgerichtete, kontextbewusste Wordlists zu generieren. Anstatt generische Wordlists zu verwenden, kann AlterX Permutationen basierend auf bekannten Subdomains erstellen und erhöht damit die Chancen, verwandte Subdomains bei Sicherheitsbewertungen und Bug-Bounty-Jagden zu entdecken.

AlterX ist darauf ausgelegt, in Kombination mit Tools wie ShuffleDNS oder anderen DNS-Brute-Force-Tools verwendet zu werden, um neue Subdomains zu entdecken, die möglicherweise nicht durch passive Enumerationsmethoden gefunden werden. Seine anpassbaren Muster und der effiziente Generierungsalgorithmus machen ihn zu einem unverzichtbaren Werkzeug für umfassende Subdomain-Enumeration.

Installation¶

Mit Go¶

Would you like me to continue with the remaining sections or translations?```bash

Install using Go (requires Go 1.20 or later)¶

go install -v github.com/projectdiscovery/alterx/cmd/alterx@latest

Verify installation¶

alterx -version

### Using Docker

```bash
# Pull the latest Docker image
docker pull projectdiscovery/alterx:latest

# Run AlterX using Docker
docker run -it projectdiscovery/alterx:latest -h

Using Homebrew (macOS)¶

# Install using Homebrew
brew install alterx

# Verify installation
alterx -version

Using PDTM (Project Discovery Tools Manager)¶

# Install PDTM first if not already installed
go install -v github.com/projectdiscovery/pdtm/cmd/pdtm@latest

# Install AlterX using PDTM
pdtm -i alterx

# Verify installation
alterx -version

On Kali Linux¶

# Install using apt
sudo apt install alterx

# Verify installation
alterx -version

Basic Usage¶

Generating Wordlists¶

# Generate wordlist using default patterns
alterx -l subdomains.txt

# Generate wordlist with specific pattern
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-dev"

# Generate wordlist from a single domain
alterx -d example.com -p "\\\\{\\\\{word\\\\}\\\\}-\\\\{\\\\{number\\\\}\\\\}"

# Generate wordlist from multiple domains
alterx -d example.com,hackerone.com -p "\\\\{\\\\{word\\\\}\\\\}-\\\\{\\\\{number\\\\}\\\\}"

Output Options¶

# Save results to a file
alterx -l subdomains.txt -o wordlist.txt

# Output in JSON format
alterx -l subdomains.txt -json -o wordlist.json

# Silent mode (only wordlist entries)
alterx -l subdomains.txt -silent

Pattern Usage¶

Basic Patterns¶

# Use word pattern (extracts words from input)
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}"

# Use number pattern (extracts numbers from input)
alterx -l subdomains.txt -p "\\\\{\\\\{number\\\\}\\\\}"

# Use character pattern (extracts characters from input)
alterx -l subdomains.txt -p "\\\\{\\\\{char\\\\}\\\\}"

# Combine multiple patterns
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-\\\\{\\\\{number\\\\}\\\\}"

Advanced Patterns¶

# Use prefix pattern
alterx -l subdomains.txt -p "dev-\\\\{\\\\{word\\\\}\\\\}"

# Use suffix pattern
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-prod"

# Use multiple patterns
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-dev,\\\\{\\\\{word\\\\}\\\\}-prod,\\\\{\\\\{word\\\\}\\\\}-stage"

# Use patterns from a file
alterx -l subdomains.txt -pf patterns.txt

Pattern Modifiers¶

# Use uppercase modifier
alterx -l subdomains.txt -p "\\\\{\\\\{word:uppercase\\\\}\\\\}"

# Use lowercase modifier
alterx -l subdomains.txt -p "\\\\{\\\\{word:lowercase\\\\}\\\\}"

# Use capitalize modifier
alterx -l subdomains.txt -p "\\\\{\\\\{word:capitalize\\\\}\\\\}"

# Use multiple modifiers
alterx -l subdomains.txt -p "\\\\{\\\\{word:lowercase:capitalize\\\\}\\\\}"

Advanced Usage¶

Word Extraction¶

# Extract words from input
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}" -extract-words

# Set minimum word length
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}" -min-word-length 3

# Set maximum word length
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}" -max-word-length 10

Number Extraction¶

# Extract numbers from input
alterx -l subdomains.txt -p "\\\\{\\\\{number\\\\}\\\\}" -extract-numbers

# Set minimum number length
alterx -l subdomains.txt -p "\\\\{\\\\{number\\\\}\\\\}" -min-number-length 1

# Set maximum number length
alterx -l subdomains.txt -p "\\\\{\\\\{number\\\\}\\\\}" -max-number-length 5

Character Extraction¶

# Extract characters from input
alterx -l subdomains.txt -p "\\\\{\\\\{char\\\\}\\\\}" -extract-chars

# Set minimum character length
alterx -l subdomains.txt -p "\\\\{\\\\{char\\\\}\\\\}" -min-char-length 1

# Set maximum character length
alterx -l subdomains.txt -p "\\\\{\\\\{char\\\\}\\\\}" -max-char-length 3

Pattern Examples¶

Common Subdomain Patterns¶

# Development environments
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-dev,dev-\\\\{\\\\{word\\\\}\\\\},\\\\{\\\\{word\\\\}\\\\}.dev"

# Staging environments
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-stage,stage-\\\\{\\\\{word\\\\}\\\\},\\\\{\\\\{word\\\\}\\\\}.stage"

# Production environments
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-prod,prod-\\\\{\\\\{word\\\\}\\\\},\\\\{\\\\{word\\\\}\\\\}.prod"

# API endpoints
alterx -l subdomains.txt -p "api-\\\\{\\\\{word\\\\}\\\\},\\\\{\\\\{word\\\\}\\\\}-api,api.\\\\{\\\\{word\\\\}\\\\}"

# Admin panels
alterx -l subdomains.txt -p "admin-\\\\{\\\\{word\\\\}\\\\},\\\\{\\\\{word\\\\}\\\\}-admin,admin.\\\\{\\\\{word\\\\}\\\\}"

Numeric Patterns¶

# Append numbers
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}\\\\{\\\\{number\\\\}\\\\}"

# Prepend numbers
alterx -l subdomains.txt -p "\\\\{\\\\{number\\\\}\\\\}\\\\{\\\\{word\\\\}\\\\}"

# Separate with hyphen
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-\\\\{\\\\{number\\\\}\\\\}"

# Separate with dot
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}.\\\\{\\\\{number\\\\}\\\\}"

Regional Patterns¶

# Geographic regions
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-us,\\\\{\\\\{word\\\\}\\\\}-eu,\\\\{\\\\{word\\\\}\\\\}-asia"

# Countries
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-uk,\\\\{\\\\{word\\\\}\\\\}-ca,\\\\{\\\\{word\\\\}\\\\}-au"

# Cities
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-nyc,\\\\{\\\\{word\\\\}\\\\}-lon,\\\\{\\\\{word\\\\}\\\\}-sfo"

Integration with Other Tools¶

Pipeline with ShuffleDNS¶

# Generate wordlist and use it for DNS brute-forcing
alterx -l subdomains.txt -silent|shuffledns -d example.com -w /dev/stdin -r resolvers.txt

# Generate wordlist, filter, and use for DNS brute-forcing
alterx -l subdomains.txt -silent|grep -v "test"|shuffledns -d example.com -w /dev/stdin -r resolvers.txt

Pipeline with Subfinder¶

# Find subdomains passively and use them to generate wordlist
subfinder -d example.com -silent|alterx -p "\\\\{\\\\{word\\\\}\\\\}-dev,\\\\{\\\\{word\\\\}\\\\}-stage" -silent

# Find subdomains, generate wordlist, and use for DNS brute-forcing
subfinder -d example.com -silent|alterx -p "\\\\{\\\\{word\\\\}\\\\}-dev" -silent|shuffledns -d example.com -w /dev/stdin -r resolvers.txt

Pipeline with HTTPX¶

# Generate wordlist, resolve domains, and probe for HTTP services
alterx -l subdomains.txt -silent|dnsx -a -resp-only|httpx -silent

# Generate wordlist for specific domain and probe for HTTP services
alterx -l subdomains.txt -p "\\\\{\\\\{word\\\\}\\\\}-api" -silent|dnsx -a -resp-only -d example.com|httpx -silent

Output Customization¶

Custom Output Format¶

# Output only wordlist entries
alterx -l subdomains.txt -silent

# Count generated entries
alterx -l subdomains.txt -silent|wc -l

# Sort output alphabetically
alterx -l subdomains.txt -silent|sort

# Remove duplicates
alterx -l subdomains.txt -silent|sort -u
```### Ausgabe filtern
```bash
# Filter by pattern
alterx -l subdomains.txt -silent|grep "dev"

# Filter out pattern
alterx -l subdomains.txt -silent|grep -v "test"

# Filter by length
alterx -l subdomains.txt -silent|awk 'length($0) < 20'
```## Erweiterte Filterung
```bash
# Filter by word count
alterx -l subdomains.txt -silent|awk 'NF==1'  # Single word
alterx -l subdomains.txt -silent|awk 'NF==2'  # Two words

# Filter by character type
alterx -l subdomains.txt -silent|grep -E '^[a-z]+

## Performance Optimization

### Concurrency and Rate Limiting

```bash
# Parallelität festlegen (Standard: 10)
alterx -l subdomains.txt -c 20

# Ratenlimit festlegen
alterx -l subdomains.txt -rate-limit 100

Optimization for Large Inputs¶

# Stream-Modus für große Eingaben verwenden
alterx -l large-subdomains.txt -stream

# Maximale Einträge begrenzen
alterx -l subdomains.txt -max-entries 1000

Troubleshooting¶

Common Issues¶

Memory Issues ```bash # Stream-Modus für große Eingaben verwenden alterx -l large-subdomains.txt -stream

# Maximale Einträge begrenzen alterx -l subdomains.txt -max-entries 1000 ```

Pattern Issues ```bash # Muster-Syntax überprüfen alterx -l subdomains.txt -p "{{word}}-dev" -debug

# Einfache Muster zuerst verwenden alterx -l subdomains.txt -p "{{word}}" ```

No Output ```bash # Eingabedatei überprüfen cat subdomains.txt

# Ausführlichen Modus verwenden alterx -l subdomains.txt -v ```

Duplicate Entries bash # Duplikate entfernen alterx -l subdomains.txt -silent|sort -u

Debugging¶

# Ausführlichen Modus aktivieren
alterx -l subdomains.txt -v

# Debug-Informationen anzeigen
alterx -l subdomains.txt -debug

# Statistiken anzeigen
alterx -l subdomains.txt -stats

Configuration¶

Configuration File¶

AlterX uses a configuration file located at $HOME/.config/alterx/config.yaml. You can customize various settings in this file:

# Beispiel-Konfigurationsdatei
concurrency: 10
rate-limit: 100
patterns:
  - "\{\{word\}\}-dev"
  - "\{\{word\}\}-stage"
  - "\{\{word\}\}-prod"

Environment Variables¶

# AlterX-Konfiguration über Umgebungsvariablen festlegen
export ALTERX_CONCURRENCY=10
export ALTERX_RATE_LIMIT=100
export ALTERX_PATTERNS="\{\{word\}\}-dev,\{\{word\}\}-stage,\{\{word\}\}-prod"

Reference¶

Command Line Options¶

Flag	Description
`-d, -domain`	Target domain(s) to use for wordlist generation
`-l, -list`	File containing list of domains to use for wordlist generation
`-p, -pattern`	Pattern(s) to use for wordlist generation
`-pf, -pattern-file`	File containing patterns to use for wordlist generation
`-o, -output`	File to write output to
`-json`	Write output in JSON format
`-silent`	Show only wordlist entries in output
`-v, -verbose`	Show verbose output
`-extract-words`	Extract words from input
`-extract-numbers`	Extract numbers from input
`-extract-chars`	Extract characters from input
`-min-word-length`	Minimum word length
`-max-word-length`	Maximum word length
`-min-number-length`	Minimum number length
`-max-number-length`	Maximum number length
`-min-char-length`	Minimum character length
`-max-char-length`	Maximum character length
`-c, -concurrency`	Number of concurrent workers
`-rate-limit`	Maximum number of entries per second
`-stream`	Stream mode for large inputs
`-max-entries`	Maximum number of entries to generate
`-stats`	Show statistics
`-debug`	Show debug information
`-version`	Show AlterX version

Pattern Variables¶

Variable	Description
`\{\{word\}\}`	Extracts words from input
`\{\{number\}\}`	Extracts numbers from input
`\{\{char\}\}`	Extracts characters from input

Pattern Modifiers¶

Modifier	Description
`:uppercase`	Converts to uppercase
`:lowercase`	Converts to lowercase
`:capitalize`	Capitalizes first letter

Resources¶

This cheat sheet provides a comprehensive reference for using AlterX, from basic wordlist generation to advanced pattern usage and integration with other tools. For the most up-to-date information, always refer to the official documentation.

# Only lowercase alterx -l subdomains.txt -silent|grep -E '[0-9]' # Contains numbers

Filter by domain pattern¶

alterx -l subdomains.txt -silent|grep -E '^api-' # Starts with "api-" alterx -l subdomains.txt -silent|grep -E '-dev

Performance Optimization¶

Concurrency and Rate Limiting¶

CODE_BLOCK_22

Optimization for Large Inputs¶

CODE_BLOCK_23

Troubleshooting¶

Common Issues¶

Memory Issues CODE_BLOCK_24
Pattern Issues CODE_BLOCK_25
No Output CODE_BLOCK_26
Duplicate Entries CODE_BLOCK_27

Debugging¶

CODE_BLOCK_28

Configuration¶

Configuration File¶

AlterX uses a configuration file located at $HOME/.config/alterx/config.yaml. You can customize various settings in this file:

CODE_BLOCK_29

Environment Variables¶

CODE_BLOCK_30

Reference¶

Command Line Options¶

Flag	Description
`-d, -domain`	Target domain(s) to use for wordlist generation
`-l, -list`	File containing list of domains to use for wordlist generation
`-p, -pattern`	Pattern(s) to use for wordlist generation
`-pf, -pattern-file`	File containing patterns to use for wordlist generation
`-o, -output`	File to write output to
`-json`	Write output in JSON format
`-silent`	Show only wordlist entries in output
`-v, -verbose`	Show verbose output
`-extract-words`	Extract words from input
`-extract-numbers`	Extract numbers from input
`-extract-chars`	Extract characters from input
`-min-word-length`	Minimum word length
`-max-word-length`	Maximum word length
`-min-number-length`	Minimum number length
`-max-number-length`	Maximum number length
`-min-char-length`	Minimum character length
`-max-char-length`	Maximum character length
`-c, -concurrency`	Number of concurrent workers
`-rate-limit`	Maximum number of entries per second
`-stream`	Stream mode for large inputs
`-max-entries`	Maximum number of entries to generate
`-stats`	Show statistics
`-debug`	Show debug information
`-version`	Show AlterX version

Pattern Variables¶

Variable	Description
`\{\{word\}\}`	Extracts words from input
`\{\{number\}\}`	Extracts numbers from input
`\{\{char\}\}`	Extracts characters from input

Pattern Modifiers¶

Modifier	Description
`:uppercase`	Converts to uppercase
`:lowercase`	Converts to lowercase
`:capitalize`	Capitalizes first letter

Resources¶

This cheat sheet provides a comprehensive reference for using AlterX, from basic wordlist generation to advanced pattern usage and integration with other tools. For the most up-to-date information, always refer to the official documentation.

 # Ends with "-dev"

```## Leistungsoptimierung

Parallelität und Ratenlimit¶

CODE_BLOCK_22

Optimierung für große Eingaben¶

CODE_BLOCK_23

Fehlerbehebung¶

Häufige Probleme¶

$HOME/.config/alterx/config.yamlSpeicherprobleme CODE_BLOCK_24

Flagge	Beschreibung
`-d, -domain`	Ziel-Domain(s) zur Verwendung für die Generierung der Wortliste
`-l, -list`	Datei mit Liste von Domains zur Verwendung für die Wortelementgenerierung
`-p, -pattern`	Muster zum Generieren von Wortlisten
`-pf, -pattern-file`	Datei mit Mustern zur Verwendung für die Wortelisten-Generierung
`-o, -output`	Datei zum Schreiben der Ausgabe
`-json`	Ausgabe im JSON-Format schreiben
`-silent`	Zeige nur Einträge der Wortliste in der Ausgabe
`-v, -verbose`	Ausführliche Ausgabe anzeigen
`-extract-words`	Wörter aus Eingabe extrahieren
`-extract-numbers`	Zahlen aus Eingabe extrahieren
`-extract-chars`	Zeichen aus Eingabe extrahieren
`-min-word-length`	Minimale Wortlänge
`-max-word-length`	Maximale Wortlänge
`-min-number-length`	Minimale Länge der Zahl
`-max-number-length`	Maximale Länge der Zahl
`-min-char-length`	Minimale Zeichenlänge
`-max-char-length`	Maximale Zeichenlänge
`-c, -concurrency`	Anzahl gleichzeitiger Worker
`-rate-limit`	Maximale Anzahl von Einträgen pro Sekunde
`-stream`	Stream-Modus für große Eingaben
`-max-entries`	Maximale Anzahl der zu generierenden Einträge
`-stats`	Statistiken anzeigen
`-debug`	Debug-Informationen anzeigen
`-version`	AlterX Version anzeigen
CODE_BLOCK_25

Variable	Beschreibung
`\\{\\{word\\}\\}`	Extrahiert Wörter aus Eingabe
`\\{\\{number\\}\\}`	Extrahiert Zahlen aus Eingabe
`\\{\\{char\\}\\}`	Extrahiert Zeichen aus Eingabe
CODE_BLOCK_26

Modifikator	Beschreibung
`:uppercase`	Konvertiert zu Großbuchstaben
`:lowercase`	Konvertiert zu Kleinbuchstaben
`:capitalize`	Großbuchstabiert den ersten Buchstaben
CODE_BLOCK_27

Debugging¶

CODE_BLOCK_28

Konfiguration¶

Konfigurationsdatei¶

AlterX verwendet eine Konfigurationsdatei, die sich an https://docs.projectdiscovery.io/tools/alterxbefindet. Sie können verschiedene Einstellungen in dieser Datei anpassen:

CODE_BLOCK_29

Umgebungsvariablen¶

CODE_BLOCK_30

Referenz¶

Befehlszeilenoptionen¶

https://github.com/projectdiscovery/alterx

Mustervariablen¶

https://discord.gg/projectdiscovery

AlterX Subdomain Wordlist Generator Cheat Sheet¶

Überblick¶

Installation¶

Mit Go¶

Install using Go (requires Go 1.20 or later)¶

Verify installation¶

Using Homebrew (macOS)¶

Using PDTM (Project Discovery Tools Manager)¶

On Kali Linux¶

Basic Usage¶

Generating Wordlists¶

Output Options¶

Pattern Usage¶

Basic Patterns¶

Advanced Patterns¶

Pattern Modifiers¶

Advanced Usage¶

Word Extraction¶

Number Extraction¶

Character Extraction¶

Pattern Examples¶

Common Subdomain Patterns¶

Numeric Patterns¶

Regional Patterns¶

Integration with Other Tools¶

Pipeline with ShuffleDNS¶

Pipeline with Subfinder¶

Pipeline with HTTPX¶

Output Customization¶

Custom Output Format¶

Optimization for Large Inputs¶

Troubleshooting¶

Common Issues¶

Debugging¶

Configuration¶

Configuration File¶

Environment Variables¶

Reference¶

Command Line Options¶

Pattern Variables¶

Pattern Modifiers¶

Resources¶

Filter by domain pattern¶

Performance Optimization¶

Concurrency and Rate Limiting¶

Optimization for Large Inputs¶

Troubleshooting¶

Common Issues¶

Debugging¶

Configuration¶

Configuration File¶

Environment Variables¶

Reference¶

Command Line Options¶

Pattern Variables¶

Pattern Modifiers¶

Resources¶

Parallelität und Ratenlimit¶

Optimierung für große Eingaben¶

Fehlerbehebung¶

Häufige Probleme¶

Debugging¶

Konfiguration¶

Konfigurationsdatei¶

Umgebungsvariablen¶

Referenz¶

Befehlszeilenoptionen¶

Mustervariablen¶

Mustermodifikatoren¶