#1Tools for discovering subdomains and DNS records associated with target domains.
Kitploit recommended
0xshe/fuck-cdnAutomated CDN origin-IP discovery skill for Claude Code that runs 40+ prioritized OSINT methods, cross-validates candidates via SSL and HTTP…
findomain/findomainThe fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain…
mmarting/unwafGo tool that passively discovers the real origin IP behind a WAF/CDN using multiple OSINT sources, then verifies candidates via HTML similarity, SSL…
projectdiscovery/subfinderFast passive subdomain enumeration tool.
piratesshield/apiharvesterThe one shot API attacker tool - finds the API url from the given root simulate the automated attacks
projectdiscovery/httpxFast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…
rix4uni/wordlistCurated collection of custom wordlists for fuzzing, DNS enumeration, parameter discovery, and default credentials, plus a Go generator for nuclei…
six2dez/reconftwreconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out…
soxoj/maigret🕵️♂️ Collect a dossier on a person by username from 6K websites
divinelabio/argusThe Ultimate Information Gathering Toolkit
laramies/theharvesterE-mails, subdomains and names Harvester - OSINT
nmap/nmapHigh-performance network discovery and security auditing tool with advanced port scanning, OS detection, service version detection, and scriptable…
h9zdev/geosentinelReal-time geospatial OSINT platform aggregating flight, vessel, and satellite data with dark web search, social media dorking, and AI-powered…
deadshot0x7/007-thebondThis Script will help you to gather information about your victim or friend.
lgandx/responderResponder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2,…
fricciolosa-red-team/evildorkAutomated Google dorking tool for extracting leaked secrets, personal information, and subdomains from a target domain or individual, outputting…
blechschmidt/massdnsA high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
spyboy-productions/cloakquest3rOpen-source security research tool for identifying origin IP exposure of websites protected by Cloudflare and similar reverse proxy services.
