DNS & Subdomain Enumeration

tomnomnom/assetfinder

Find domains and subdomains related to a given domain

soxoj/maigret

🕵️‍♂️ Collect a dossier on a person by username from 3000+ sites

unapibageek/ctfr

Abusing Certificate Transparency logs for getting HTTPS websites subdomains.

projectdiscovery/awesome-search-queries

Community curated list of search queries for various products across multiple search engines.

yousseflahouifi/moniorg

Passive domain monitoring tool leveraging Certificate Transparency logs to discover and track newly issued domains for an organization, with Slack…

laramies/theharvester

E-mails, subdomains and names Harvester - OSINT

owasp-amass/amass

In-depth attack surface mapping and asset discovery

projectdiscovery/subfinder

Fast passive subdomain enumeration tool.

oj/gobuster

Directory/File, DNS and VHost busting tool written in Go

s0md3v/photon

Incredibly fast crawler designed for OSINT.

lockfale/osint-framework

Curated framework of free OSINT tools and resources for gathering intelligence from public sources, organized by category with structured metadata…

yogeshojha/rengine

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines,…

lgandx/responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2,…

ghosttroops/scan4all

Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port…

elceef/dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

lc/gau

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

lucksi/mr.holmes

Modular OSINT framework for gathering intelligence on domains, usernames, phone numbers, and emails using public sources, Google dorks, and…