Tools

Generates subdomain permutations and alterations from a wordlist of common patterns (dev, staging, api-v2) and resolves the results.

altdns -i subdomains.txt -o data_output -w words.txt -r -s results.txt

OWASP in-depth attack-surface mapping tool: DNS enumeration, subdomain discovery via dozens of passive sources, and network-mapping graph output.

amass enum -passive -d example.com -o subdomains.txt

A tool for visual inspection of websites across a large list of hosts, producing an HTML report of screenshots grouped by similarity — an older but still-used alternative to gowitness/EyeWitness.

cat hosts.txt | aquatone

On-demand webpage archiving service that snapshots a page instantly, useful for preserving content that blocks the Wayback Machine's crawler or that changes quickly.

Team Cymru's whois service answers an IP's ASN, prefix, country and registry in a single query, with no API key required.

whois -h whois.cymru.com " -v 1.1.1.1"

Small Go tool that finds domains and subdomains related to a given domain from a handful of free sources — a lightweight complement to heavier enumerators.

assetfinder --subs-only example.com

A quick parallel PTR sweep across a /24 without needing a dedicated scanner installed.

for i in $(seq 1 254); do host 10.10.10.$i & done 2>/dev/null | grep -v 'not found'

Free API and website for ASN, prefix and peering data, a lighter alternative to the Hurricane Electric toolkit for scripted lookups.

curl -s https://api.bgpview.io/ip/1.1.1.1

Bluetooth reconnaissance framework covering Classic, LE and (some) mesh/Zigbee-adjacent radios in one CLI, aimed at building a fuller picture than a single-mode scanner.

bluing le scan

One of the original S3-bucket-name brute-forcing tools — checks a wordlist of candidate names for existence and public read access.

ruby bucket_finder.rb wordlist.txt

Web technology profiler — identifies the CMS, analytics, ad networks, frameworks and hosting stack behind a site, plus historical technology-adoption lookups.

Resolves a large subdomain candidate list against a set of trusted public resolvers far faster than looping dig/host over each name.

massdns -r resolvers.txt -t A -o S -w results.txt subdomains.txt

Email OSINT tool that checks an address against breach data, social-media registration and domain information in one pass.

buster -e [email protected] -b

Quick lookup tool for a page's Google cache and Wayback Machine snapshot from one search box, useful when a page has just gone offline or been edited.

Lyft-originated tool that consolidates infrastructure and cloud asset relationships (AWS, GCP, GitHub, Okta, etc.) into a Neo4j graph for attack-surface and blast-radius analysis.

cartography --neo4j-uri bolt://localhost:7687

An internet-wide device and certificate search engine built from continuous internet scanning — heavily used for attack-surface discovery and certificate-based host enumeration.

Internet-wide scan search engine for hosts, services and certificates, built from continuous scanning of the public IPv4 space plus a hosted certificate-transparency index.

Dataset and API of continuously-crawled subdomain data for public bug-bounty-in-scope domains, maintained by ProjectDiscovery and queryable via their CLI.

chaos -d example.com -silent

Multi-cloud OSINT tool that enumerates public storage buckets, apps and resources across AWS, Azure and GCP for a given keyword or company name.

python3 cloud_enum.py -k example

Brute-forces likely bucket/storage-account names across AWS, Azure, GCP, DigitalOcean and other providers to find exposed cloud storage tied to a target company or brand.

cloudbrute -d example -k "example,exampleco" -o output.txt

Generates network diagrams of AWS environments from live account data, helping identify unexpected public exposure across VPCs and security groups.

python3 cloudmapper.py collect --account example

Open, petabyte-scale repository of web crawl data, usable to find historical pages, linking patterns or exposed content at a scale no single scraper could reach.

Geolocation OSINT tool that aggregates geotagged social-media posts for a target into a mapped timeline, a historically significant project in this space.

Threat-intel-flavoured internet asset search engine combining Shodan-like banner search with IP risk scoring, phishing/malicious-URL lookups and domain intel.

Enumerates a company's LinkedIn employees via search-engine scraping (no LinkedIn login needed) and outputs plausible email addresses from the naming pattern.

python3 crosslinked.py -f "{first}.{last}@example.com" example.com

A free, searchable front-end over Certificate Transparency logs — the fastest way to enumerate every subdomain that has ever had a public TLS certificate issued for it.

curl -s 'https://crt.sh/?q=%.target.tld&output=json' | jq -r '.[].name_value' | sort -u

Certificate transparency search engine indexing CT logs for domain and subdomain discovery, with a faster/more filterable UI than crt.sh for large result sets.

OSINT framework that aggregates information about domains, emails, usernames and phone numbers from multiple public sources into one report.

Free web-based domain research tool that maps a domain's DNS records, subdomains and hosting relationships, with a graphical network map.

A classic Perl DNS enumeration tool — zone transfers, MX/NS/A record lookups, Google scraping for subdomains and brute-force, bundled into one script that predates most of the newer Go-based DNS tools.

dnsenum example.com

Reverse-lookup service for Google Analytics/AdSense IDs, nameservers and shared IPs — surfaces other domains run by the same operator even when WHOIS is hidden.

A Python DNS enumeration and reconnaissance tool covering standard record enumeration, zone transfers, SRV record checks, reverse lookups over a range and Google/Bing subdomain scraping in one tool.

dnsrecon -d example.com -t std,brt

A fast, multi-purpose DNS toolkit from ProjectDiscovery — bulk resolution, wildcard filtering and record-type querying built for piping into and out of the rest of that project's recon tool chain.

subfinder -d example.com | dnsx -a -resp

WHOIS lookup and historical WHOIS record database, widely used for domain ownership research and infrastructure attribution even after WHOIS privacy became the default.

Runs a set of search-engine dork queries and feeds the resulting URLs into a scanning module, chaining discovery and light vulnerability checks in one tool.

dorkbot -i google -q "inurl:admin" -s xss_scanner

Lists historical URLs archived under a domain via the CDX API, useful for finding old parameters, endpoints or files that were later removed from the live site.

curl -s "http://web.archive.org/cdx/search/cdx?url=*.example.com/*&output=text&fl=original&collapse=urlkey"

GCS exposes bucket listings over a plain JSON endpoint; a misconfigured bucket returns its full object list to an unauthenticated request.

curl -s "https://storage.googleapis.com/storage/v1/b/target-bucket/o" | jq "."

Pulls every certificate-transparency-logged hostname for a domain straight from crt.sh's JSON API, no browser needed.

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r ".[].name_value" | sort -u

Takes screenshots of a large list of web services and organises them into a browsable report — the fastest way to triage which of a thousand open ports is actually worth looking at by hand.

eyewitness --web -f urls.txt -d report/

RDAP is the structured-JSON successor to WHOIS; rdap.org routes the query to the right registry and hands back machine-readable output.

curl -s https://rdap.org/domain/example.com | jq ".events, .entities"

A DNS reconnaissance tool that locates non-contiguous IP space and hostnames against a target domain — zone transfer attempts, wordlist-based subdomain brute-forcing and reverse lookups to map a domain's DNS footprint.

fierce --domain example.com

Fast Rust subdomain enumerator that queries certificate-transparency logs and multiple passive-DNS APIs, with an optional monitoring mode for new subdomains.

findomain -t example.com -o

Internet asset search engine (Huawei/Baimaohui-affiliated) with its own query syntax for finding hosts by banner, title, certificate or icon hash.

Attack-surface search engine and monitoring platform that continuously tracks a company's exposed hosts, subdomains and services.

Fetches known URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and urlscan.io — a broader net than waybackurls alone.

echo target.tld | gau

Google account OSINT tool that resolves a Gmail address to its Google ID, name, profile photo and exposure across Google services (Maps reviews, calendar, photos).

ghunt email [email protected]

Scan a git repository's full history for accidentally committed secrets (API keys, tokens, credentials) rather than just the current checkout.

pip install trufflehog3
trufflehog3 https://github.com/org/repo.git
# or the Go rewrite, scanning a local clone including history:
trufflehog git file://./repo

Exploit-DB's long-running, categorised archive of Google dorks for finding exposed files, login portals, error messages and vulnerable systems via search-engine indexing.

Subdomain-permutation generator similar in purpose to altdns, with adjustable permutation depth and its own wordlist format.

gotator -sub subdomains.txt -perm permutations.txt -depth 1 -numbers 3

A Go-based web screenshot utility built for the same triage job as EyeWitness, using a headless Chrome for the capture and shipping as a single static binary.

gowitness scan file -f urls.txt

One loop instead of six separate dig invocations when you want the full picture of a domain's A/AAAA/MX/TXT/NS/SOA/CNAME records.

for t in A AAAA MX TXT NS SOA CNAME; do echo "== $t =="; dig +short example.com "$t"; done

Email OSINT and breach-hunting tool that aggregates results from Have I Been Pwned, breach-directory APIs and local dump files against a target address.

h8mail -t [email protected]

CLI tool that checks whether an email address is registered on 120+ websites (via password-reset/registration timing leaks), without ever notifying the target.

holehe [email protected]

ProjectDiscovery's fast, multi-purpose HTTP probing tool — takes a list of hosts and reports which are alive, their titles, status codes, tech stack and more, in one pass.

cat subdomains.txt | httpx -title -tech-detect -status-code

Fast, multi-purpose HTTP toolkit for probing a large list of hosts/subdomains — status codes, titles, tech fingerprints and TLS data — as a recon pipeline stage.

cat subs.txt | httpx -title -tech-detect -status-code

Finds and verifies professional email addresses tied to a domain, including the naming pattern a company uses — a staple for recon during phishing-simulation and social-engineering engagements.

Looks up an ASN's announced prefixes, peers and reverse-DNS in-bulk, a go-to reference for understanding whose network address space actually belongs to.

Checks whether a phone number is registered on services such as Instagram, Snapchat and Amazon by abusing account-recovery flows, without alerting the target.

ignorant 33 612345678

Gathers email account information (source, validity, associated hostname) from public search engines and PGP key servers for a target domain.

python3 infoga.py --domain example.com --source all -v 2

A companion search-tool page (distinct from the methodology site above) that auto-builds search-engine and social-media queries for a target across many services from one form.

IP geolocation and ASN lookup API/website, commonly wired into recon scripts for a quick org/location answer on an IP list.

curl -s ipinfo.io/1.1.1.1

Simple bulk IP-to-ASN lookup service with a downloadable dataset, useful when you need to tag a large IP list with owning ASN offline.

Open-source network recon framework for running your own internet-wide or internal scans and organising the results in a queryable database, essentially a self-hosted Shodan.

Gathers and visualises passive intelligence about a set of IP addresses (geolocation, org, historical activity) without touching the hosts themselves.

A fast web crawler from ProjectDiscovery built for security testing — headless-browser-aware, JavaScript-parsing crawl that feeds URLs straight into fuzzing or nuclei.

katana -u https://target.tld -jc -d 3

Open-data search engine that indexes misconfigured/exposed services and leaked data found on the public internet, including open databases and plaintext credential leaks.

If a bucket's ACL allows public listing, the AWS CLI enumerates it anonymously — the fastest possible bucket-exposure sanity check.

aws s3 ls s3://target-bucket-name --no-sign-request

Username OSINT tool that collects a person's accounts across thousands of sites and can generate an HTML/PDF report, going further than a simple existence check by pulling profile data.

maigret target_username --html

A graphical link-analysis platform for OSINT — runs "transforms" against an entity (domain, email, person) and draws the results as an explorable graph rather than a flat list.

Crowd-sourced street-level imagery platform, used in geolocation OSINT to visually corroborate a building, sign or landmark against a claimed location.

An asynchronous, internet-scale port scanner capable of scanning the entire IPv4 address space in under six minutes — trades nmap's depth for raw speed, then hands results to nmap for the detail pass.

masscan -p1-65535 10.10.10.0/24 --rate 10000

Extracts metadata (author names, software versions, paths) from public documents discovered via search engines for a target domain.

metagoofil -d example.com -t pdf,doc,xls -l 50 -n 20 -o results -f results.html

Search engine that lets you strip out the top N most popular results, surfacing the obscure long tail a normal search buries — handy in dorking when the top results are all noise.

A fast SYN/CONNECT port scanner from ProjectDiscovery, built to slot into a recon pipeline (subfinder -> naabu -> httpx -> nuclei) rather than run standalone.

naabu -host target.tld -top-ports 1000

Web service that checks username and domain availability across a large set of social networks and platforms simultaneously.

A domain's hosting history in one report — IP history, hosting provider changes, detected technology and a risk rating, often used to attribute infrastructure moves.

Internet-scanning search engine covering hosts, domains, certificates and WHOIS, positioned as a cheaper alternative to Shodan/Censys with a similar dork syntax.

Fast asynchronous username-existence checker that verifies a handle across a large curated site list, positioned as a quicker alternative to sequential checkers.

nexfil -u target_username

Network Mapper — port scanning, service/version detection and scriptable auditing (NSE) for discovery and security assessment.

nmap -sC -sV -T4 -oA initial <ip or host>

ProjectDiscovery's fast, template-driven vulnerability scanner — thousands of community-maintained YAML templates cover CVEs, misconfigurations and exposed panels across a target list in one pass.

nuclei -u https://target.tld -t cves/ -severity critical,high

Cyber defense search engine that collects internet-wide scan, passive DNS and threat data and exposes it via a query language and API for attack-surface discovery.

Not a tool but a curated, clickable index of OSINT tools and resources organised by category — the map most people start from before they know which specific tool they need.

Michael Bazzell's long-running OSINT resource site, companion to the "OSINT Techniques" book, with categorised tool links and methodology notes kept current as sites change.

OSINT tool for gathering information (followers, tagged photos, comments, likely-related accounts) from a public Instagram profile.

osintgram target_username

Automated reconnaissance framework that chains subdomain enumeration, port scanning, screenshotting and vulnerability scanning into one workflow for large-scope bug-bounty recon.

osmedeus scan -t example.com

Query tool for raw OpenStreetMap data — e.g. find every building matching a roof shape or every fuel station within a radius, useful for geolocation candidates.

Automates passive Google Hacking Database dork queries against a target domain and saves the matching results, rather than running each dork by hand.

python3 pagodo.py -d example.com -g dorks.txt -l 100 -s

Mines URLs with parameters straight out of the Wayback Machine for a target domain — a fast way to build an attack surface list without touching the live site at all.

paramspider -d target.tld

Search-engine dork pattern for finding leaked credentials or source snippets accidentally posted to public paste sites for a target domain.

site:pastebin.com "example.com" (password OR api_key OR secret)
# repeat against site:ghostbin.com, site:paste.ee, site:rentry.co for broader paste-site coverage

Renders the mountain skyline visible from any point on Earth and names each peak, used to geolocate a photo by matching its visible ridgeline.

Phone-number OSINT tool that gathers carrier, line type and geolocation data, then cross-references OSINT sources and search-engine footprints for a number.

phoneinfoga scan -n "+15551234567"

Fast OSINT-focused web crawler that extracts URLs, emails, social-media handles, subdomains and files (with metadata) from a target site as it crawls.

python3 photon.py -u https://example.com -l 3 --wayback

Source-code search engine that lets you grep the indexed web for a snippet — a tracking ID, a JS library string or a signature left by a specific web shell/skimmer.

Wraps massdns for reliable bulk DNS resolving and subdomain brute-forcing, with automatic wildcard detection so a wildcard DNS record does not flood results with false positives.

puredns bruteforce wordlist.txt example.com -r resolvers.txt

The structured-JSON successor to WHOIS; rdap.org routes a query to the correct registry and returns machine-parseable output instead of free-text WHOIS.

A full reconnaissance framework with a Metasploit-like module system — dozens of OSINT modules for domains, hosts, contacts and credentials, chained through one console.

Automated recon shell script that wraps subfinder, httpx, nuclei and many other tools into one pipeline for full domain reconnaissance ahead of a pentest or bug-bounty hunt.

./reconftw.sh -d example.com -r

Walks every address in a range and runs a PTR lookup on each, a fast way to spot hostnames that hint at a network's internal layout.

for ip in $(prips 10.0.0.0/24); do dig +short -x "$ip"; done

Finds netblocks and ASNs registered to a company name before subdomain enumeration even starts, using Amass's intel gathering rather than its enum mode.

amass intel -org "Example Inc"

RIPE NCC's tool for exploring routing history, WHOIS and geolocation data for any IP, prefix or ASN, backed by RIPE's own registry and RIS routing data.

Free tier of Microsoft's threat-intel platform (formerly RiskIQ PassiveTotal) offering passive DNS, WHOIS history and certificate data for infrastructure investigations.

An extremely fast port scanner written in Rust that pipes its results straight into nmap for service detection — the "scan the internet in seconds" front end to nmap's slower, thorough back end.

rustscan -a 10.10.10.10 -- -sC -sV

Scans for open/misconfigured Amazon S3 buckets given a list of bucket-name candidates, reporting existence and public read/write access.

s3scanner scan --bucket-file bucket-names.txt

Historical and current DNS/WHOIS intelligence platform — passive DNS history, IP neighbor lists and subdomain data, popular for infrastructure attribution.

Nonprofit that scans the internet at scale and sends free daily exposure/compromise reports to the network owners who register for them.

Hunts for a given username across hundreds of social media and web platforms at once, reporting back exactly where an account with that handle exists.

sherlock username

Username/email OSINT tool searching hundreds of sites in parallel with browser-based verification, aiming for fewer false positives than a plain HTTP-status username checker.

blackbird -u target_username

The original internet-wide device search engine — indexes banners from scanning the whole IPv4 space, so you can search for exposed services, devices and misconfigurations by product, port or CVE.

shodan search "apache" country:DK

Shodan's own reference for its search filter syntax (product, port, org, ssl.cert, etc.) — essential for turning a vague "find exposed X" into a precise query.

ProjectDiscovery wrapper around massdns for subdomain brute-forcing and resolution, built to plug into the rest of their recon toolchain.

shuffledns -d example.com -w wordlist.txt -r resolvers.txt

OSINT scraping framework that aggregates public-record and people-search sites (courts, social media, phone directories) against a target name.

skiptracer -m full -q "Jane Doe"

Semi-automated OSINT framework and local recon database for correlating people, phone numbers, domains and subdomains across a long-running investigation.

sn0int

API/CLI/web tool that analyzes and finds a person's profiles across 1000+ social platforms, using detection modules beyond simple username-exists checks.

python3 app.py --username johndoe --metadata --output web

An OSINT automation engine — point it at a domain, IP, email or name and it fans out across 200+ data-source modules to map the external attack surface and threat exposure.

spiderfoot -s target.tld -u all

An automation engine for OSINT, but used heavily on the offensive side too: point it at a domain and it fans out across dozens of data sources to map the whole external attack surface.

spiderfoot -s target.tld -u all

ProjectDiscovery's fast passive subdomain enumeration tool, pulling from dozens of public sources and APIs; built to pipe cleanly into the rest of their toolchain.

subfinder -d example.com -all -o subs.txt

Gathers emails, subdomains, hosts and employee names for a target domain from a wide range of public sources — usually the first command run in the OSINT phase of an engagement.

theHarvester -d target.tld -b all

Full-featured web reconnaissance framework with a modular, Metasploit-style console — API-backed modules for domains, hosts, contacts and credentials pulled into one workspace.

recon-ng -w workspace

Resolves an Instagram username or numeric user ID to hashed email, hashed phone number and account-creation date via the platform's own API responses.

toutatis -u target_username

Chains tomnomnom's waybackurls with ProjectDiscovery's httpx to turn archived history into a live-host check in one pipeline.

echo example.com | waybackurls | httpx -silent

Advanced Twitter/X scraping tool that historically worked without API keys or rate limits; the project is archived/broken against the current X platform but still referenced in OSINT methodology write-ups.

Free suite of small DNS/network lookup tools — reverse WHOIS, reverse IP, DNS history, port scan — useful when you need one quick answer without standing up your own tooling.

Identifies and fingerprints which web application firewall (if any) is protecting a target site, based on response behaviour to a set of probes.

wafw00f https://example.com

Browser extension and API that fingerprints the technology stack of a website (CMS, JS frameworks, server software, analytics) from passive page signals.

Internet Archive's historical web snapshot service — recovers deleted pages, old site structure, past staff/contact pages and prior versions of JS/robots.txt for recon.

Pulls every URL the Wayback Machine has ever archived for a domain — a quick, passive way to surface old endpoints, parameters and forgotten paths that are still live.

echo target.tld | waybackurls

Username-enumeration project (web UI and open JSON data set) that checks a handle across hundreds of sites, maintained as a community-curated alternative to Sherlock's site list.

CLI website fingerprinting tool with 1800+ plugins identifying CMS, JS libraries, web servers and embedded devices from HTTP responses.

whatweb -a 3 https://example.com

Bulk and reverse WHOIS lookup service — finds every other domain registered with the same email address or registrant name.

User-annotated satellite map where buildings and points of interest carry free-text descriptions, useful for identifying an unnamed structure in a photo.

Chinese-run internet device/service search engine indexing banners, ports and web components, comparable in scope to Shodan/Censys with different vantage points.