Tools

0xshe/fuck-cdn

Automated CDN origin-IP discovery skill for Claude Code that runs 40+ prioritized OSINT methods, cross-validates candidates via SSL and HTTP…

mmarting/unwaf

Go tool that passively discovers the real origin IP behind a WAF/CDN using multiple OSINT sources, then verifies candidates via HTML similarity, SSL…

findomain/findomain

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain…

rix4uni/wordlist

Curated collection of custom wordlists for fuzzing, DNS enumeration, parameter discovery, and default credentials, plus a Go generator for nuclei…

piratesshield/apiharvester

The one shot API attacker tool - finds the API url from the given root simulate the automated attacks

divinelabio/argus

The Ultimate Information Gathering Toolkit

projectdiscovery/httpx

Fast, multi-probe HTTP toolkit for reconnaissance and information gathering. Probes TLS, CSP, headers, tech stack, and CDN. Supports matchers,…

six2dez/reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out…

projectdiscovery/subfinder

Fast passive subdomain enumeration tool.

deadshot0x7/007-thebond

This Script will help you to gather information about your victim or friend.

nmap/nmap

High-performance network discovery and security auditing tool with advanced port scanning, OS detection, service version detection, and scriptable…

h9zdev/geosentinel

Real-time geospatial OSINT platform aggregating flight, vessel, and satellite data with dark web search, social media dorking, and AI-powered…

lgandx/responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2,…

fricciolosa-red-team/evildork

Automated Google dorking tool for extracting leaked secrets, personal information, and subdomains from a target domain or individual, outputting…

laramies/theharvester

E-mails, subdomains and names Harvester - OSINT

soxoj/maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

spyboy-productions/cloakquest3r

Open-source security research tool for identifying origin IP exposure of websites protected by Cloudflare and similar reverse proxy services.

blechschmidt/massdns

A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)