Skip to content
Deepak Gupta markRecon Atlas

Research a competitor

What does a company's public footprint say about its products and stack?

Public records already describe a lot about a company: subdomains reveal products and regions, certificates reveal launch dates, archived URLs show what pages existed, and fingerprinting shows the stack. This job lists passive tools only, which read third-party sources and never send traffic to the company's systems.

Before you start

  • Passive tools only. Port scans, brute-force DNS, crawling and probing another company's systems need its permission.
  • Read public information, never access anything behind a login, paywall or access control.
  • Follow the terms of service of every data source the tools query.

  1. 01Subdomain discovery

    Which hostnames exist under this domain?

    • subfinderPassive

      Finds subdomains of a domain by querying passive online sources such as certificate logs and DNS datasets.

      15k stars · last push November 9, 2026 · v2.17.0 · MIT

  2. 02Internet exposure search

    What have internet-wide scanners already recorded about these hosts?

    • MetabigorPassive

      OSINT CLI that maps IP ranges, certificate subdomains, related domains, archived URLs and CDN use from free sources, no API key needed.

      1.9k stars · last push August 8, 2026 · v2.2.0 · MIT

    • uncoverPassive

      Queries Shodan, Censys, FOFA and other internet search engine APIs at once to list exposed hosts and ports.

      3.1k stars · last push November 9, 2026 · v1.2.1 · MIT

  3. 03URL and endpoint discovery

    Which pages, parameters and API paths exist?

    • getallurls (gau)Passive

      Pulls known historical URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and URLScan.

      5.2k stars · last push October 12, 2026 · v2.2.4 · MIT

    • URLFinderPassive

      Passive URL discovery tool from ProjectDiscovery that gathers a domain's known URLs from public archives and intel sources.

      921 stars · last push November 9, 2026 · v0.0.3 · MIT

    • waybackurlsPassiveLow activity

      Minimal stdin/stdout tool that lists URLs the Wayback Machine has recorded for a domain and its subdomains.

      4.6k stars · last push May 1, 2024 · v0.1.0 · No licence file

Other jobs: Scope a pentest · Audit your own exposure