DNS & Subdomain Enumeration

laramies/theharvester

E-mails, subdomains and names Harvester - OSINT

lockfale/osint-framework

Curated framework of free OSINT tools and resources for gathering intelligence from public sources, organized by category with structured metadata…

s0md3v/photon

Incredibly fast crawler designed for OSINT.

projectdiscovery/subfinder

Fast passive subdomain enumeration tool.

projectdiscovery/httpx

Fast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…

owasp-amass/amass

In-depth attack surface mapping and asset discovery

six2dez/reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out…

oj/gobuster

Directory/File, DNS and VHost busting tool written in Go

aboul3la/sublist3r

Fast subdomains enumeration tool for penetration testers

yogeshojha/rengine

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines,…

apurvsinghgautam/dark-web-osint-tools

OSINT Tools for the Dark Web

lgandx/responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2,…

unapibageek/ctfr

Abusing Certificate Transparency logs for getting HTTPS websites subdomains.

findomain/findomain

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain…

darkoperator/dnsrecon

DNS Enumeration Script

elceef/dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation