#1Tools for discovering subdomains and DNS records associated with target domains.
Kitploit recommended

The most exhaustive list of reliable DNS resolvers.
Take a list of domains and probe for working HTTP and HTTPS servers

A Lightning-Fast DNS Resolver written in Rust 🦀

OSINT tool that finds domains, subdomains, directories, endpoints and files for a given seed URL.

A Windows application to help out with external infrastructure scans.

A BASH Script to automate the installation of the most popular bug bounty tools

Network, recon and offensive-security tool for Linux.

Recon, Subdomain Bruting, Zone Transfers

This tool uses a combination of dictionary-based wordlists (brute-force) and DNS resolution checks to verify the existence of subdomains.


Published security research repository featuring academic papers on domain hijacking, 2FA bypass, and large-scale spoofing techniques, authored by…

Locally-hosted, air-gapped VAPT platform that runs 8 parallel scanning modules, deterministically scores findings with CVSS v3.1, and generates PDF…

Curated collection of Google dork queries for advanced search engine reconnaissance, uncovering exposed databases, configuration files, admin panels,…

Stuff that doesn't deserves its own repository.

Command-line tool for discovering SaaS platforms a company uses via DNS enumeration

Automatically Launch Google Hacking Queries Against A Target Domain

Fast and passive subdomain enumeration.