#1Subdomain discovery, DNS brute-force, certificate transparency, and asset enumeration tools.
Kitploit recommended
mschwager/fierceA DNS reconnaissance tool for locating non-contiguous IP space.
projectdiscovery/alterxFast and customizable subdomain wordlist generator using DSL
viralmaniar/bigbountyreconBigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial…
projectdiscovery/shufflednsMassDNS wrapper written in go to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard filtering and easy…
dheerajmadhukar/karma_v2⡷⠂𝚔𝚊𝚛𝚖𝚊 𝚟𝟸⠐⢾ is a Passive Open Source Intelligence (OSINT) Automated Reconnaissance (framework)
projectdiscovery/urlfinderA high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.
franccesco/getaltnameExtract subdomains from SSL certificates in HTTPS sites.
chvancooten/bugbountyscannerA Bash script and Docker image for Bug Bounty reconnaissance. Intended for headless use.
twelvesec/gasmaskInformation gathering tool - OSINT
infobyte/emploleaksAn OSINT tool that helps detect members of a company with leaked credentials
superhedgy/attacksurfacemapperAttackSurfaceMapper is a tool that aims to automate the reconnaissance process.
m3n0sd0n4ld/goofuzzBash-based fuzzing tool that leverages Google Dorking for stealthy enumeration of directories, files, subdomains, and parameters without direct…
anshumanbh/tko-subsA tool that can help detect and takeover subdomains with dead DNS records
h4r5h1t/webcopilotAn automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for…
devxprite/infooozeA OSINT tool which helps you to quickly find information effectively. All you need is to input and it will take take care of rest.
gal-nagli/shockwave-ossCurated collection of bug bounty tips, one-liners, and automation workflows for recon, fuzzing, and web exploitation, with private nuclei templates…
anmolksachan/thetimemachineWeaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not
boy-hack/ksubdomainSubdomain enumeration tool, asynchronous dns packets, use pcap to scan 1600,000 subdomains in 1 second
