DNS & Subdomain Enumeration

lucksi/mr.holmes

Modular OSINT framework for gathering intelligence on domains, usernames, phone numbers, and emails using public sources, Google dorks, and…

xssdoctor/vhostawesome

Concurrent virtual host scanner that brute-forces subdomains across multiple IPs on common web ports, filtering results by status codes and content…

yousseflahouifi/dorkish

Chrome extension tool for OSINT & Recon

misterch0c/twitterbftd

Twitter Back From The Dead looks in a user tweets history for domain names that are available for registration

chiasmod0n/chiasmodon

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves…

a3h1nt/sububy

Modular subdomain enumeration suite with certificate transparency, DNS brute-force, and API-based discovery. Includes post-enumeration modules for…

mrcl0wnlab/scanner-inurlbr

Advanced search in search engines, enables analysis provided to exploit GET / POST capturing emails & urls, with an internal custom validation…

hueristiq/xsubfind3r

Passive subdomain discovery tool that aggregates results from multiple online sources via CLI, supporting stdin/stdout, JSONL output, and API key…

g0ldencybersec/easyeasm

Zero-dollar attack surface management tool

redhuntlabs/antisquat

AI-powered typosquatting and phishing domain detector using NLP and ChatGPT to generate domain permutations and extract contact information from…

trickest/cloud

Monitoring the Cloud Landscape

yousseflahouifi/cloudpulse

SSL certificate-based reconnaissance engine for discovering AWS cloud assets, including IPs, subdomains, and domains, with active port scanning for…

ecstatic-nobel/osweep

Don't Just Search OSINT. Sweep It.

researchanddestroy/dorxng

Next Generation DorX. Built by Dorks, for Dorks. 🤓

yousseflahouifi/moniorg

Passive domain monitoring tool leveraging Certificate Transparency logs to discover and track newly issued domains for an organization, with Slack…