Tools: recon (229)

Enumerate AD through LDAP.

An LDAP based Active Directory user and group enumeration tool.

Active Directory audit tool that extract data from Bloodhound to uncover security weaknesses and generate an HTML report

AD Explorer snapshot parser.

Active Directory Integrated DNS dumping by any authenticated user.

Python 3 DNS asynchronous brute force utility.

A Tool for Domain Flyovers.

ASN, RPKI validity, BGP stats, IPv4v6, Prefix, URL, ASPath, Organization, IP reputation, IP geolocation, IP fingerprinti

Tool that aims to automate the reconnaissance process.

Tool to automate common osint tasks.

Discover resources created in an AWS account.

A footprinting tool for ROS and SROS systems.

Advanced network reconnaissance toolkit.

Tool that can extract TLD (Top Level Domain), domain extensions (Second Level Domain + TLD), domain name, and hostname f

Multipurpose scanner built to automate your Recon, Bug Bounties, and ASM.

An automated tool that checks for backup artifacts that may disclose the web-application's source code.

Information Gathering tool for a Website or IP address.

Python data collector for Bloodhound legcacy (v4)

Scrape employee names from search engine LinkedIn profiles. Convert employee names to a specified username format.

An application to query the canary.pw data set for leaked data.

Retrieves from the CommonCrawl data set unique subdomains for a given domain name.

Go client to communicate with Chaos dataset API.

ICMP Timestamp Remote Time Leaker.

A library of OSINT tools.

A tool that checks Cloudflare enabled sites for origin IP leaks.

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network.

A tool for listing Assets from multiple Cloud Providers.

A simple tool to find origin servers of websites protected by CloudFlare with a misconfiguration DNS.

Reconnaissance Real IP address for Cloudflare Bypass.

Search for public leaks for email addresses + check creds against 16 websites.

Performs automated OSINT and more.

DGA Domain Detection using Bigram Frequency Analysis.

PoC for an adaptive parallelised DNS prober.

Multi-theaded DNS bruteforcing, average speed 80 lookups/second with 40 threads.

DNS subdomain bruteforcing tool with Tor support through torsocks.

A utility for quickly searching presorted DNS names.

Allows you to perform multiple dns queries of your choice with a list of user supplied resolvers.

A subdomain enumeration tool.

A fast multithreaded bruteforcer of subdomains that leverages a wordlist and/or character permutation.

Finds all the security information for a given domain name.

A web API to deliver domain information from whois and alexa.

Multi Tool Subdomain Enumeration.

Checks expired domains for categorization/reputation and Archive.org history to determine good candidates for phishing a

An open source framework to enable effective information sharing.

Horizontal domain discovery tool you can use to discover other domains owned by a given company.

A next generation version of enum4linux

Enumerate the permissions associated with an AWS credential set.

Enumerate RIDs using pure Python.

A fast and modular scanner for Tor exit relays.

designed to take screenshots of websites, provide some server header info, and identify default credentials is possible

A facebook profile and reconnaissance system.

IP lookup by favicon using Shodan.

Weaponizing favicon.ico for BugBounties , OSINT and what not.

Show info about the author by facebook photo url.

Automated Information Gathering Tool for Penetration Testers.

Multithreaded threat Intelligence gathering utilizing.

All in one Information gathering tool - OSINT.

Network auditing and analysis tool developed in Python.

This little tools is designed to get geolocalization information of a host, it get the information from two sources (max

Github dorking tool.

An offensive OSINT Google framework.

Pinpoints exposed API keys on GitHub. A batch-catching, pattern-matching, patch-attacking secret snatcher.

A tool to hunt for credentials in github wild AKA git*hunt.

Python program to scrape secrets from GitHub through usage of a large repository of dorks.

A Github organization reconnaissance tool.

Monitor GitHub to search and find sensitive data in real time for different online services.

A `.git` folder disclosure exploit.

Collection of github dorks and helper tool to automate the process of checking dorks.

Find subdomains on GitHub.

An information gathering tool to collect git commit emails in version control host services.

Tool for advanced mining for content on Github.

OSINT tool to get information from a Github and Gitlab profile and find user's email addresses leaked on commits.

Utility to enumerate users, groups and computers from a Windows domain through LDAP queries.

Dumps Active Directory domain information.

A python script designed to allow you to leverage the power of google dorking straight from the comfort of your command

Enumerate domain emails from google.

A python script to find domains by using google dorks.

Automatically Launch Google Hacking Queries Against A Target Domain.

Perform google searches without being blocked by the CAPTCHA or hitting any rate limits.

OSINT framework in Go.

A golang web screenshot utility using Chrome Headless

Counts all the hostnames for an IP adress

GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce.

Enumeration of GWT-RCP method calls.

Small, fast tool for performing reverse DNS lookups en masse.

A repository crawler that runs checksums for static files found within a given git repository.

Discover the vhosts using google and bing.

Bypass CloudFlare with Ruby.

Trace URL's jumps across the rel links to obtain the last URL.

Count the number of people around you by monitoring wifi signals.

Search for information related to a domain: Emails - IP addresses - Domains - Information on WEB technology - Type of Fi

A collection of tools that allows to test network intrusion detection systems.

Tool for gathering e-mail accounts information from different public sources (search engines, pgp key servers).

OSINT Gathering Tool for Companies and Organizations.

OSINT Tool to Mark Points on Offline Map.

Traceroute-like application piggybacking on existing TCP connections

Track and retrieve any ip address information.

A small memory/CPU footprint daemon to lookup country (and other info) based on IP (v4 and v6).

This tool extract domains from IP address based in the information saved in virustotal.

Golang IPv6 address enumeration.

Tool to gather information from IRC servers.

Simple html parsing tool that extracts all form related information and generates reports of the data. Allows for quick

Network recon framework based on Nmap, Masscan, Zeek (Bro), Argus, Netflow,... (documentation)

Network recon framework based on Nmap, Masscan, Zeek (Bro), Argus, Netflow,... (web application)

Collect all information in your domain, show you graphs on how domain objects interact with each-other and how to exploi

Simple script that grep infos from javascript files.

Tools for penetration testers that can enumerate which users logged on windows system.

Build interactive map of cameras from Shodan.

Recon tool detecting changes of websites based on content-length differences.

Passive network mapping tool.

Enumerate domain controllers using LDAP.

A layer four traceroute implementing numerous other features.

A modular recon tool for pentesting.

A Perl script that tries to suggest exploits based OS version number

Linux privilege escalation auditing tool.

OSINT tool to get informations on French, Belgian and Swizerland people.

Sensitive information extraction tool.

A tool for collecting intelligence from public sites/feeds about various security-related pieces of data.

Tool to harvest emails from website.

SSL Vulnerability Scanner.

An mDNS recon tool written in Python.

Intelligence Tool but without API key.

Search for documents in a domain through Search Engines (Google, Bing and Baidu). The objective is to extract metadata.

Dotmil subdomain discovery tool that scrapes domains from official DoD website directories and certificate transparency

A local network host discovery tool. In passive mode, it will listen for ARP request and reply packets. In active mode,

Script to enumerate network attached storages.

Python Script that search unused Virtual Hosts in Web Servers.

Facebook CDN Photo Resolver.

BSD-finger ported to Linux.

Logged in users; Displays who is logged in to machines on local network.

Remote who client and server (with Debian patches).

OSINT tool that finds domains, subdomains, directories, endpoints and files.

The system admins best friend, multi platform auditing tool.

A tool to enumerate the resource records of a DNS zone using its DNSSEC NSEC or NSEC3 chain.

Enumerate domain names using DNSSEC.

A tool to enumerate information from NTLM authentication enabled web endpoints.

Script to pull addresses from a NTP server using the monlist command. Can also output Maltego resultset.

Tool that can be used to enumerate OS information, domain information, shares, directories, and users through SMB null s

OSINT tool for intelligence collection, research and artifact management.

An onion url inspector for inspecting deep web links.

OSINT investigation framework

Performs OSINT scan on email/domain/ip_address/organization.

Open Source Toolkit for Open Source Intelligence Gathering.

OSINT tool offering an interactive shell to perform analysis on Instagram account of any users by its nickname.

A Robots.txt audit tool

Scrape Pastebin API to collect daily pastes, setup a wordlist and be alerted by email when you have a match..

Tool for searching pdfs withthin google and extracting pdf metadata.

Organizational asset discovery tool with 20+ plugins covering certificate transparency, passive DNS, and all 5 Regional

A tool for quickly evaluating IAM permissions in AWS.

Clean, nice and easy tool for basic/advanced privilege escalation techniques.

Python script that helps you investigate Protonmail accounts and ProtonVPN IP addresses.

Hunt domain names using DNSDumpster, WHOIS, Reverse WHOIS, Shodan, Crimeflare.

Fast domain resolver and subdomain bruteforcing with accurate wildcard filtering.

A command-line tool for querying the 'Have I been pwned?' service.

Pwned Password API lookup.

Tool to find passwords for compromised email addresses.

Auto Scanning to SSL Vulnerability.

Unofficial Python API for http://dnsdumpster.com/.

Network recon framework based on Nmap, Masscan, Zeek (Bro), Argus, Netflow,... (library)

Unofficial Python API for http://dnsdumpster.com/.

Network recon framework based on Nmap, Masscan, Zeek (Bro), Argus, Netflow,... (library)

Python library and command-line utility for Shodan (https://developer.shodan.io).

A python script for simple information gathering. It attempts to find subdomain names, perform zone transfers and gather

A high performance offensive security tool for reconnaissance and vulnerability scanning.

A python script to extract information from a Microsoft Remote Desktop Web Access (RDWA) application.

A full-featured Web Reconnaissance framework written in Python.

A security tool for multithreaded information gathering and service enumeration.

Network reconnaissance and vulnerability assessment tools.

Tool for doing Footprinting and Reconnaissance on the target web.

All in one tool for Information Gathering, Vulnerability Scanning and Crawling.

Ruby based reverse IP-lookup tool.

A simple reverse IP domain scanner.

Enumerate usernames on a domain where you have no creds by using SMB Relay with low priv.

A script which maps domains related to an given ip address or domainname.

Real Intelligence Threat Analytics.

Active Directory data collector for BloodHound community edition (v5).

Amazon S3 bucket enumeration.

Crawler (Bot) searching for credential leaks on different paste sites.

Fast Subnet Discovery.

Find Advanced Information on a Username, Website, Phone Number, etc.

A multi-purpose OSINT toolkit with a neat web-interface.

A script that monitors and extracts requested URLs and clients connected to the service by exploiting publicly accessibl

A command line tool to detect shared passwords.

Find committed secrets and sensitive files across GitHub, Gists, GitLab and BitBucket or your local repositories in real

Search for hosts info with shodan.

Small tool to Grab subdomains using Shodan API.

Email recon made fast and easy, with a framework to build on CyberSyndicates.

Simple IP Information Tools for Reputation Data Analysis.

3 tools that work together to simplify reconnaissance of Windows File Shares.

A social networking service scraper in Python.

Check email address and username availability on online platforms.

A program to map out SPF and DKIM records for a large number of domains.

Simple script that checks a domain for email protections.

Python API wrapper and command-line client for the tools hosted on spyse.com.

Perform subdomain enumeration, endpoint recognition, and more.

CN (Common Name) grabber on X.509 Certificates over HTTPS.

Github stargazers information gathering tool.

A tool designed for obtaining subdomain names from public sources.

A security and reconnaissance tool which leverages certificate transparency to automatically monitor new subdomains depl

Tool that performs subdomain enumeration through various techniques.

A simple script to extract all web resources by means of .SVN folder exposed over network.

An OSINT tool for discovering associated sites through Google Analytics Tracking IDs.

Recursive DNS Subdomain Enumerator with dead-end avoidance system.

User enumeration with Microsoft Teams API

Comprehensive collection of Google Dorks & OSINT techniques to find Confidential Data.

Python tool for gathering e-mail accounts and subdomain names from different public sources (search engines, pgp key servers)

An easy and simple tool implemented in Python for ip reconnaissance, with reverse ip lookup.

Get detailed information about a Twitter user activity.

The most complete open-source tool for Twitter intelligence analysis.

Hunt for sensitive information through githubs code search.

A Tool for DNS Delegation Trust Graphing.

A Ubiquiti device discovery tool.

Bash script that uses advanced Google search techniques to obtain sensitive information in files or directories, find Io

Script to enumerate Office 365 users without performing login attempts

Discover exposed hosts on the internet using multiple search engines.

Find usernames across over 75 social networks.

Virtual hosts brute forcer.

Explore the network using this tool.

A lightweight and multithreaded directory and subdomain bruteforcer implemented in Python.

Fetch all the URLs that the Wayback Machine knows about for a domain.

Find way more from the Wayback Machine, Common Crawl, Alien Vault OTX, URLScan & VirusTotal.

Search vhost names given a host range. Powered by Bing..

DNS Enumeration with Asynchronicity.

A reverse whois tool based on Whoxy API.

Script to enumerate users, groups and computers from a Windows domain through LDAP queries.

This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential miss

A tool for recon, mapping and OSINT gathering from public networks.

Advanced dork searching utility.

Grab banners (optionally over TLS).