DNS & Subdomain Enumeration

projectdiscovery/tlsx

Fast and configurable TLS grabber focused on TLS based data collection.

d4rkcat/dnsbrute

Multi theaded DNS bruteforcing

stealth/fernmelder

async mass DNS resolver

zombiesam/googlesub

This script will try to find a domains subdomains by using google dorking. It will never connect to the site it is researching.

projectdiscovery/alterx

Fast and customizable subdomain wordlist generator using DSL

projectdiscovery/tldfinder

A streamlined tool for discovering private TLDs for security research.

projectdiscovery/awesome-search-queries

Community curated list of search queries for various products across multiple search engines.

projectdiscovery/interactsh-web

Web dashboard for Interactsh client

projectdiscovery/retryabledns

Retryable DNS client in Go

projectdiscovery/urlfinder

A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.

nullt3r/rapiddns

Rapidly enumerate subdomains and domains using rapiddns.io.

projectdiscovery/chaos-client

Go client to communicate with Chaos DB API.

aarocy/recon-scan

Recon-Scan: open‑source passive reconnaissance with AI‑powered security analysis. Zero‑touch, developer‑first, and privacy‑focused.

siv-nick/whocord

Scans Discord links across mutual guilds to extract profiles, cross‑references 700+ sites, searches usernames with 30+ tools, and generates an…

hackinglz/saas_enum

Command-line tool for discovering SaaS platforms a company uses via DNS enumeration

spyboy-productions/cloakquest3r

Open-source security research tool for identifying origin IP exposure of websites protected by Cloudflare and similar reverse proxy services.

elceef/dnstwist

Domain name permutation engine for detecting homograph phishing attacks, typo squatting, and brand impersonation

bountystrike/bountystrike-sh

Poor (rich?) man's bug bounty pipeline https://dubell.io