Open-source recon tools, organised by the job you are doing

33 of 33 tools

• Screenshots and visual triage

  AquatoneActiveArchived

  Archived Go tool that probes common web ports on hosts, screenshots responsive sites with Chromium and clusters them in an HTML report.

• Recon frameworks

  BBOTPassive and active modes

  Recursive Python scanner with presets for subdomains, emails, cloud assets, web spidering and web scanning, inspired by SpiderFoot.

• URL and endpoint discovery

  cariddiActive

  Crawls a list of domains and scans the pages it fetches for endpoints, secrets, API keys, error messages and notable file types.

• DNS resolution and enumeration

  dnsxActive

  Fast DNS toolkit that resolves, queries record types, brute forces names and filters wildcard DNS for lists of hosts.

• DNS resolution and enumeration

  FierceActiveLow activity

  Python DNS reconnaissance tool that tries a zone transfer, guesses subdomains, and scans nearby IPs to find non-contiguous IP space.

• Recon frameworks

  FinalReconPassive and active modes

  Single Python script for a quick web recon overview: headers, TLS, WHOIS, DNS, subdomains, crawling, directories, Wayback and ports.

• URL and endpoint discovery

  getallurls (gau)Passive

  Pulls known historical URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and URLScan.

• URL and endpoint discovery

  getJSActive

  Extracts JavaScript source URLs from web pages or piped HTTP responses, as a CLI and as a Go package.

• Code and secret leaks

  GitleaksPassive

  Regex-based secrets scanner for auditing your own git history, directories and piped input, with pre-commit and CI support.

• Screenshots and visual triage

  gowitnessActive

  Go tool that screenshots websites with headless Chrome from URL lists, CIDRs or Nmap/Nessus results and serves a browsable report.

• URL and endpoint discovery

  HakrawlerActive

  Lightweight Go crawler that reads URLs from stdin and prints the links and JavaScript file locations it finds.

• HTTP probing

  httpxActive

  Multi-purpose HTTP probing toolkit that checks which hosts serve web content and reports status, title, server, TLS and technology data.

• URL and endpoint discovery

  KatanaActive

  Web crawler that maps URLs and endpoints on a target site, with an optional headless browser mode for JavaScript-heavy apps.

• Port scanning

  MASSCANActive

  Asynchronous Internet-scale port scanner with nmap-like flags, its own TCP/IP stack and optional banner grabbing on common protocols.

• DNS resolution and enumeration

  MassDNSActive

  High-performance DNS stub resolver in C for resolving millions of names, often used for subdomain brute forcing.

• Internet exposure search

  MetabigorPassive

  OSINT CLI that maps IP ranges, certificate subdomains, related domains, archived URLs and CDN use from free sources, no API key needed.

• Port scanning

  NaabuPassive and active modes

  Go port scanner doing fast SYN, CONNECT and UDP scans across hosts, CIDRs and ASNs, with CDN exclusion and Nmap hand-off.

• Port scanning

  NmapActive

  Network scanner that discovers live hosts, open ports, service versions and operating systems, with a Lua scripting engine for extra checks.

• Recon frameworks

  OsmedeusActive

  Go workflow engine that runs security scans defined in YAML, with distributed workers, a web UI and a queryable asset database.

• Subdomain discovery

  OWASP AmassPassive and active modes

  Maps an organization's external attack surface from open sources, with optional zone transfers, certificate grabs and DNS brute force.

• Recon frameworks

  Recon-ngPassive and active modes

  Python framework with a Metasploit-style console for modular web-based OSINT, storing harvested data in a per-workspace database.

• Recon frameworks

  reconFTWPassive and active modes

  Bash orchestrator that chains dozens of recon tools for subdomains, OSINT, web analysis and optional vulnerability checks.

• Recon frameworks

  reNginePassive and active modes

  Self-hosted web UI that runs YAML-configured recon scan engines and stores results in a database for filtering and reports.

• DNS resolution and enumeration

  shuffleDNSActive

  Go wrapper around massdns that brute forces or resolves subdomains at high volume and filters wildcard DNS.

• Recon frameworks

  sn0intPassive and active modes

  Rust OSINT framework and module package manager that runs sandboxed Lua modules and stores entities in a typed database.

• Recon frameworks

  SpiderFootPassive and active modes

  Python OSINT automation tool with 200+ modules, a web UI and CLI, correlating data about domains, IPs, emails, names and more.

• Subdomain discovery

  subfinderPassive

  Finds subdomains of a domain by querying passive online sources such as certificate logs and DNS datasets.

• Subdomain discovery

  theHarvesterPassive and active modes

  OSINT collector that gathers hostnames, emails, IPs, URLs, ASNs and breach names for a domain from 66 public sources.

• Code and secret leaks

  TruffleHogPassive and active modes

  Secrets scanner for auditing your own repositories, buckets and images, with checks that confirm whether a found credential is still live.

• Internet exposure search

  uncoverPassive

  Queries Shodan, Censys, FOFA and other internet search engine APIs at once to list exposed hosts and ports.

• URL and endpoint discovery

  URLFinderPassive

  Passive URL discovery tool from ProjectDiscovery that gathers a domain's known URLs from public archives and intel sources.

• URL and endpoint discovery

  waybackurlsPassiveLow activity

  Minimal stdin/stdout tool that lists URLs the Wayback Machine has recorded for a domain and its subdomains.

• Technology fingerprinting

  WhatWebActive

  Ruby web fingerprinter with 1800+ plugins that identifies CMSs, frameworks, servers, analytics, JavaScript libraries and versions.