#1Tools for discovering subdomains and DNS records associated with target domains.
Kitploit recommended
joda32/yowieFinds the SaaS services an organisation subscribes to, using only externally observable data. Built for shadow IT discovery.
hilmiazizi/ooreconTerminal UI for attack surface discovery: DNS recon, subdomain enumeration, port scanning, reverse IP, leaked login URLs, and JavaScript secret…
darkrx1/rxscanRust CLI for bounded network reconnaissance: TCP/UDP port discovery, service identification, DNS/TLS/HTTP evidence collection, and public-source…
piratesshield/apiharvesterThe one shot API attacker tool - finds the API url from the given root simulate the automated attacks
vqkro/higernesa passive OSINT toolkit in python and c++ usernames, emails, domains, ips, phones, hashes. no keys, no logins.
ankhcorp/nuke.shBash-based passive reconnaissance + attack surface mapping script using only public APIs + stock Linux tools (curl, dig, openssl, nmap, python3).
rix4uni/wordlistCurated collection of custom wordlists for fuzzing, DNS enumeration, parameter discovery, and default credentials, plus a Go generator for nuclei…
mmarting/unwafGo tool that passively discovers the real origin IP behind a WAF/CDN using multiple OSINT sources, then verifies candidates via HTML similarity, SSL…
0xshe/fuck-cdnAutomated CDN origin-IP discovery skill for Claude Code that runs 40+ prioritized OSINT methods, cross-validates candidates via SSL and HTTP…
divinelabio/argusThe Ultimate Information Gathering Toolkit
rthalley/dnspythonPython DNS toolkit supporting queries, zone transfers, dynamic updates, TSIG, EDNS0, DNSSEC, DNS-over-HTTPS, and DNS-over-QUIC with high- and…
clickswave/limeyardDeliberately vulnerable Docker lab with a routable DNS estate and machine-readable answer keys per target, scoring scanner precision, recall and…
voidsecsoftwares/voidsec-proxyMulti-module offensive security toolkit for SOCKS5 proxy chaining, port scanning, DNS enumeration, hash cracking, reverse shell generation,…
gmh5225/domain-enumeration-sicariusAnother tool for subdomain enumeration with some magics 🧙🏻♂️
alephnullsk/dnsgenGenerates domain name permutations for subdomain enumeration and recon, supporting custom wordlists, cloud patterns, and fast mode for security…
hakluke/hakrevdnsSmall, fast tool for performing reverse DNS lookups en masse.
wattocyber/vegadnsRust-based DNS enumeration and subdomain discovery tool for reconnaissance and penetration testing security assessments.
azmisyahrul/prismsecSecure, modular MCP server wrapping nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap for AI-powered pentesting
