#1Tools for discovering subdomains and DNS records associated with target domains.
Kitploit recommended
mhaskar/exchangefinderFind Microsoft Exchange instance for a given domain and identify the exact version
ecstatic-nobel/osweepDon't Just Search OSINT. Sweep It.
rix4uni/wordlistCurated collection of custom wordlists for fuzzing, DNS enumeration, parameter discovery, and default credentials, plus a Go generator for nuclei…
0xshe/fuck-cdnAutomated CDN origin-IP discovery skill for Claude Code that runs 40+ prioritized OSINT methods, cross-validates candidates via SSL and HTTP…
pwnwriter/kanha🦚 A web-app pentesting suite written in rust .
misterch0c/twitterbftdTwitter Back From The Dead looks in a user tweets history for domain names that are available for registration
g0ldencybersec/easyeasmZero-dollar attack surface management tool
hash3lizer/subrake🚀 A DNS automated scanner and tool 🖱️ (Zone Transfer, DNS Zone Takeover, Subdomain Takeover).
mrcl0wnlab/scanner-inurlbrAdvanced search in search engines, enables analysis provided to exploit GET / POST capturing emails & urls, with an internal custom validation…
nerrorsec/google-dorkerAutomate dorking while doing bug bounty or other stuffs.
milindpurswani/syborgRecursive DNS Subdomain Enumerator with dead-end avoidance system (BETA)
josue87/analyticsrelationshipsGet related domains / subdomains by looking at Google Analytics IDs
nccgroup/typofinderA finder of domain typos showing country of IP address
blindfuzzy/lhfA modular recon tool for pentesting
frishtik/osint-tools-mcp-serverMCP server exposing multiple OSINT tools for AI assistants like Claude
projectdiscovery/tldfinderA streamlined tool for discovering private TLDs for security research.
projectdiscovery/retryablednsRetryable DNS client in Go
