Tools that recon

Gather open-source intelligence about a target.

90 tools indexed

cariddi

—

Crawl domains for endpoints, secrets, API keys and tokens.

ReconScanWeb apps

GoGPL-3.0

dnstwist

—

Detect typosquats and phishing domains.

ScanReconWeb apps

PythonApache-2.0

enumerate-iam

—

Enumerate AWS IAM permissions.

ReconCloud

PythonBSD-3-Clause

feroxbuster

—

Fast recursive content discovery in Rust.

FuzzReconWeb apps

RustMIT

fscan

—

Intranet comprehensive scanner.

ScanExploitNetworksActive Directory

GoMIT

github-dorks

—

Find leaked secrets via GitHub search.

ReconSource codeWeb apps

PythonMIT

holehe

—

Check which sites an email address is registered on

ReconWeb apps

PythonGPL-3.0

httpx

—

Fast HTTP toolkit.

ReconScanWeb apps

GoMIT

ldapdomaindump

—

AD information dumper via LDAP.

ReconActive Directory

PythonMIT

linuxprivchecker

—

Linux privesc enumeration script.

ReconScanEndpoints

PythonCustom

pspy

—

Spy on Linux processes without root.

MonitorReconEndpoints

GoMIT

reNgine

—

Automated reconnaissance framework for web applications

ReconScanWeb appsNetworks

PythonGPL-3.0

reconFTW

—

Automated recon and web vulnerability-scanning framework.

ReconScanWeb appsNetworks

ShellMIT

sn0int

—

Semi-automatic OSINT framework.

ReconAutomateWeb appsNetworks

RustGPL-3.0

snowpick

—

Scan ServiceNow instances for unauthenticated data exposure

ScanReconWeb appsCloud

GoMIT

theHarvester

—

E-mail and subdomain harvester.

ReconWeb appsNetworks

PythonGPL-2.0

wafw00f

—

WAF fingerprinting.

ReconScanWeb apps

PythonBSD-3-Clause

waybackurls

—

Historical URLs from the Wayback Machine.

ReconWeb apps

GoMIT