Reconnaissance

28 tools · Passive and active information gathering to map the attack surface

Subdomain Enumeration

Discover subdomains of a target domain

Subfinder

Fast passive subdomain enumeration tool

Sublist3r

Python-based subdomain enumeration using OSINT

Amass

In-depth attack surface mapping and asset discovery

SubDomainizer

Find subdomains and secrets in JS files and pages

Assetfinder

Find domains and subdomains related to a domain

OneForAll

Powerful subdomain integration tool

theHarvester

E-mail, subdomain, and name harvester (OSINT)

Findomain

Cross-platform subdomain enumerator

Chaos

Go client for ProjectDiscovery Chaos DNS API

Knockpy

Subdomain enumeration via wordlist

AltDNS

Subdomain permutation and mutation generator

hakrevdns

Fast reverse DNS lookups en masse

DNS Enumeration

DNS record resolution, brute forcing, and analysis

dnsx

Fast multi-purpose DNS toolkit for record queries

ShuffleDNS

Wrapper around massdns for active brute forcing

MassDNS

High-performance bulk DNS resolution

dnscan

Python wordlist-based DNS subdomain scanner

Asset Discovery

Discover URLs, endpoints, and web assets

Katana

Next-generation crawling and spidering framework

GAU

Fetch known URLs from multiple OSINT sources

Waybackurls

Fetch URLs from the Wayback Machine

GoSpider

Fast web spider written in Go

Hakrawler

Simple, fast web crawler for endpoint discovery

Crawley

Feature-rich unix-way web crawler in Go

HTTP Probing

Probe hosts for live HTTP/HTTPS services

httpx

Fast HTTP toolkit with multiple probes

httprobe

Quick HTTP/HTTPS prober

Link & JS Analysis

Extract endpoints and links from JavaScript files

LinkFinder

Find endpoints in JavaScript files

getJS

Quickly get all JavaScript sources from a page

GoLinkFinder

Fast and minimal JS endpoint extractor

SecretFinder

Find sensitive data in JavaScript files

Back to All Categories