Tools

h9zdev/wiretapper

Passive wireless OSINT platform that detects and maps Wi-Fi, Bluetooth, CCTV, IoT devices, and cell towers using radio signal intelligence for…

m3n0sd0n4ld/goofuzz

Bash-based fuzzing tool that leverages Google Dorking for stealthy enumeration of directories, files, subdomains, and parameters without direct…

codingo/vhostscan

A virtual host scanner that performs reverse lookups, can be used with pivot tools, detect catch-all scenarios, work around wildcards, aliases and…

nahamsec/hostilesubbruteforcer

Subdomain brute-forcing tool that enumerates existing subdomains and detects misconfigured cloud-hosted subdomains vulnerable to takeover across AWS,…

fwaeytens/dnsenum

dnsenum is a perl script that enumerates DNS information

s0md3v/dump

Stuff that doesn't deserves its own repository.

silverpoision/rock-on

Rock-On is a all in one Recon tool that will just get a single entry of the Domain name and do all of the work alone.

misterch0c/twitterbftd

Twitter Back From The Dead looks in a user tweets history for domain names that are available for registration

0xshe/fuck-cdn

Automated CDN origin-IP discovery skill for Claude Code that runs 40+ prioritized OSINT methods, cross-validates candidates via SSL and HTTP…

mmarting/unwaf

Go tool that passively discovers the real origin IP behind a WAF/CDN using multiple OSINT sources, then verifies candidates via HTML similarity, SSL…

caio-ishikawa/netscout

OSINT tool that finds domains, subdomains, directories, endpoints and files for a given seed URL.

yuyudhn/tldhunt

Bash-based domain availability checker that scans WHOIS records across multiple TLDs to find unregistered domains for red teaming and phishing…

a3h1nt/subcert

Passive subdomain enumeration tool that extracts valid subdomains from certificate transparency logs using Python, ideal for reconnaissance and bug…

hueristiq/xsubfind3r

Passive subdomain discovery tool that aggregates results from multiple online sources via CLI, supporting stdin/stdout, JSONL output, and API key…

micro-joan/dnsrecon-gui

Graphical DNS enumeration tool for Kali Linux that scans standard records (A, NS, SOA, MX) and visualizes results in mind maps for reconnaissance and…

joda32/certcrunchy

Just a silly recon tool that uses data from SSL Certificates to find potential host names

xssdoctor/vhostawesome

Concurrent virtual host scanner that brute-forces subdomains across multiple IPs on common web ports, filtering results by status codes and content…