#1Tools for discovering subdomains and DNS records associated with target domains.
Kitploit recommended
pentestcore/cloudflare-bypassCloudflare Bypass tools | PentestCore
aarocy/recon-scanRecon-Scan: open‑source passive reconnaissance with AI‑powered security analysis. Zero‑touch, developer‑first, and privacy‑focused.
hilmiazizi/ooreconTerminal UI for attack surface discovery: DNS recon, subdomain enumeration, port scanning, reverse IP, leaked login URLs, and JavaScript secret…
whitelisthackers/wosindAn OSINT tool for collecting public information.
nccgroup/hostresolverA Windows application to help out with external infrastructure scans.
nu11secur1ty/complete-google-dorksCurated collection of Google dork queries for advanced search engine reconnaissance, uncovering exposed databases, configuration files, admin panels,…
d4rkcat/dnsbruteMulti theaded DNS bruteforcing
tegal1337/recheckDeep scan domain and find all possible domain to takeover
xpl0ited1/submonitorSubdomain monitor with reporting capabilities to Slack, Discord and Telegram
abaykan/getsubdomainGet subdomain list and check whether they are active or not by each response code. Using API by c99.nl
a3h1nt/sububyModular subdomain enumeration suite with certificate transparency, DNS brute-force, and API-based discovery. Includes post-enumeration modules for…
vqkro/higernesa passive OSINT toolkit in python and c++ usernames, emails, domains, ips, phones, hashes. no keys, no logins.
voidsecsoftwares/voidsec-proxyMulti-module offensive security toolkit for SOCKS5 proxy chaining, port scanning, DNS enumeration, hash cracking, reverse shell generation,…
joda32/yowieFinds the SaaS services an organisation subscribes to, using only externally observable data. Built for shadow IT discovery.
clickswave/limeyardDeliberately vulnerable Docker lab with a routable DNS estate and machine-readable answer keys per target, scoring scanner precision, recall and…
darkrx1/rxscanRust CLI for bounded network reconnaissance: TCP/UDP port discovery, service identification, DNS/TLS/HTTP evidence collection, and public-source…
wattocyber/vegadnsRust-based DNS enumeration and subdomain discovery tool for reconnaissance and penetration testing security assessments.
azmisyahrul/prismsecSecure, modular MCP server wrapping nmap, nuclei, gobuster, subfinder, httpx, nikto, sqlmap for AI-powered pentesting
