Tools that recon

Username OSINT across 3000+ sites.

Self-hostable email OSINT platform, no API keys required.

Graph-based OSINT and link analysis.

Mass IP port scanner.

Fast port scanner in Go.

Fast service fingerprinting CLI for 170+ protocols

Network service exploitation.

The classic network mapper and port scanner.

Modular Go framework for attack surface management and scanning

Local-first link-analysis and geospatial board for investigations.

In-depth attack surface mapping.

AI-powered OSINT agent with REPL, CLI and MCP server.

Evaluate IAM permissions in AWS.

Open-source AWS exploitation framework.

Burp extension for parameter discovery.

OSINT framework for phone numbers.

PowerShell post-exploitation framework.

PowerShell AD post-exploitation.

Full-featured reconnaissance framework.

AI-powered agentic red team framework.

Modern port scanner in Rust.

Find misconfigured object storage buckets.

BloodHound collection via ADWS.

Find and exploit sudo misconfigurations.