#1Subdomain discovery, DNS brute-force, certificate transparency, and asset enumeration tools.
Kitploit recommended
1n3/sn1perAutomated penetration testing & attack surface management platform. Recon, scan, exploit, report - 600+ exploits, 90+ integrations, 10K+ detections.
lissy93/web-check🕵️♂️ All-in-one OSINT tool for analysing any website
soxoj/maigret🕵️♂️ Collect a dossier on a person by username from 6K websites
projectdiscovery/nucleiFast YAML-based vulnerability scanner with template-driven detection engine for automated security testing across web apps, APIs, networks, DNS, and…
hevnsnt/cvengineAI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration.
olizimmermann/s3dnsPassive DNS server that detects exposed cloud storage buckets (AWS S3, GCP, Azure) by resolving DNS requests, tracing CNAME chains, and flagging…
projectdiscovery/urlfinderA high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.
projectdiscovery/subfinderFast passive subdomain enumeration tool.
projectdiscovery/dnsxdnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.
pennacle-security/summitOpen-source web security testing platform: proxy, scanner and fuzzer in one CLI. By Pennacle Security.
karim852/kumo-domain-recon-toolDomain OSINT and security reconnaissance framework running 26 parallel modules for DNS, ports, subdomains, leaked credentials, exposed endpoints,…
wddadk/offensive-osint-toolsCurated list of OSINT tools for offensive security, covering email harvesting, subdomain enumeration, threat intelligence, and social engineering for…
owasp-amass/amassIn-depth attack surface mapping and asset discovery
projectdiscovery/httpxFast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…
projectdiscovery/tldfinderA streamlined tool for discovering private TLDs for security research.
projectdiscovery/alterxFast and customizable subdomain wordlist generator using DSL
borntoberoot/networkmanagerA powerful open-source tool for managing networks and troubleshooting network problems!
