Tools that recon

Evaluate IAM permissions in AWS.

Open-source AWS exploitation framework.

Burp extension for parameter discovery.

OSINT framework for phone numbers.

PowerShell post-exploitation framework.

PowerShell AD post-exploitation.

Full-featured reconnaissance framework.

Modern port scanner in Rust.

Find misconfigured object storage buckets.

BloodHound collection via ADWS.

Find and exploit sudo misconfigurations.

Analyze Windows sandboxes.

Offline Exploit-DB CLI.

The security tester's wordlist collection.

C# BloodHound collector.

.NET post-exploitation library.

Hunt usernames across social networks.

Find juicy files on Windows shares.

Find a profile across 1000+ networks.

Automated OSINT collection.

CVE intelligence and exploit lookup CLI.

Passive subdomain discovery.

Cross-platform O365 / AAD attack framework.

All-in-one OSINT for any website.