Categories
Subdomain discovery
Which hostnames exist under this domain?
OWASP Amass · subfinder · theHarvester
DNS resolution and enumeration
Which of these names resolve, and to what?
dnsx · Fierce · MassDNS · shuffleDNS
Internet exposure search
What have internet-wide scanners already recorded about these hosts?
Metabigor · uncover
Port scanning
Which network services are listening?
MASSCAN · Naabu · Nmap
HTTP probing
Which hosts run a web server, and what does it return?
httpx
URL and endpoint discovery
Which pages, parameters and API paths exist?
cariddi · getallurls (gau) · getJS · Hakrawler · Katana · URLFinder · waybackurls
Technology fingerprinting
What software and versions sit behind a website?
WhatWeb
Screenshots and visual triage
Which of these web apps are worth a closer look?
Aquatone · gowitness
Code and secret leaks
Has anyone committed credentials or keys to code?
Gitleaks · TruffleHog
Recon frameworks
Can one tool run the whole workflow?
BBOT · FinalRecon · Osmedeus · Recon-ng · reconFTW · reNgine · sn0int · SpiderFoot