Audit your own exposure
What can anyone on the internet see about my organisation?
Attackers run these same tools against you. Running them first shows forgotten subdomains, staging hosts, open services, old URLs still in web archives and secrets committed to public code. Treat every finding as an inventory question: who owns this, and should it be public?
Before you start
- Scan only domains, IP ranges and repositories your organisation owns or controls.
- Tell your hosting and cloud providers' acceptable-use teams if their terms require notice for scanning.
- Rotate any secret you find in code, even in a deleted commit. Git history keeps it.
01Subdomain discovery
Which hostnames exist under this domain?
- OWASP AmassPassive and active modes
Maps an organization's external attack surface from open sources, with optional zone transfers, certificate grabs and DNS brute force.
15k stars · last push November 11, 2026 · v5.1.3 · Apache-2.0
- subfinderPassive
Finds subdomains of a domain by querying passive online sources such as certificate logs and DNS datasets.
15k stars · last push November 9, 2026 · v2.17.0 · MIT
- theHarvesterPassive and active modes
OSINT collector that gathers hostnames, emails, IPs, URLs, ASNs and breach names for a domain from 66 public sources.
18k stars · last push November 10, 2026 · 4.11.1 · GPL-2.0
02Internet exposure search
What have internet-wide scanners already recorded about these hosts?
- MetabigorPassive
OSINT CLI that maps IP ranges, certificate subdomains, related domains, archived URLs and CDN use from free sources, no API key needed.
1.9k stars · last push August 8, 2026 · v2.2.0 · MIT
- uncoverPassive
Queries Shodan, Censys, FOFA and other internet search engine APIs at once to list exposed hosts and ports.
3.1k stars · last push November 9, 2026 · v1.2.1 · MIT
03URL and endpoint discovery
Which pages, parameters and API paths exist?
- cariddiActive
Crawls a list of domains and scans the pages it fetches for endpoints, secrets, API keys, error messages and notable file types.
3.8k stars · last push November 5, 2026 · v1.4.6 · GPL-3.0
- getallurls (gau)Passive
Pulls known historical URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and URLScan.
5.2k stars · last push October 12, 2026 · v2.2.4 · MIT
- getJSActive
Extracts JavaScript source URLs from web pages or piped HTTP responses, as a CLI and as a Go package.
902 stars · last push August 29, 2026 · v2.0.0 · MIT
- HakrawlerActive
Lightweight Go crawler that reads URLs from stdin and prints the links and JavaScript file locations it finds.
5.2k stars · last push August 5, 2026 · 2.1 · GPL-3.0
- KatanaActive
Web crawler that maps URLs and endpoints on a target site, with an optional headless browser mode for JavaScript-heavy apps.
18k stars · last push November 9, 2026 · v1.8.0 · MIT
- URLFinderPassive
Passive URL discovery tool from ProjectDiscovery that gathers a domain's known URLs from public archives and intel sources.
921 stars · last push November 9, 2026 · v0.0.3 · MIT
Minimal stdin/stdout tool that lists URLs the Wayback Machine has recorded for a domain and its subdomains.
4.6k stars · last push May 1, 2024 · v0.1.0 · No licence file
04Code and secret leaks
Has anyone committed credentials or keys to code?
- GitleaksPassive
Regex-based secrets scanner for auditing your own git history, directories and piped input, with pre-commit and CI support.
31k stars · last push October 28, 2026 · v8.30.1 · MIT
- TruffleHogPassive and active modes
Secrets scanner for auditing your own repositories, buckets and images, with checks that confirm whether a found credential is still live.
29k stars · last push November 10, 2026 · v3.99.8 · AGPL-3.0
05Port scanning
Which network services are listening?
- MASSCANActive
Asynchronous Internet-scale port scanner with nmap-like flags, its own TCP/IP stack and optional banner grabbing on common protocols.
26k stars · last push October 5, 2026 · 1.3.2 · AGPL-3.0
- NaabuPassive and active modes
Go port scanner doing fast SYN, CONNECT and UDP scans across hosts, CIDRs and ASNs, with CDN exclusion and Nmap hand-off.
6.4k stars · last push November 9, 2026 · v2.7.0 · MIT
- NmapActive
Network scanner that discovers live hosts, open ports, service versions and operating systems, with a Lua scripting engine for extra checks.
14k stars · last push November 9, 2026 · LicenseRef-NPSL
06HTTP probing
Which hosts run a web server, and what does it return?
- httpxActive
Multi-purpose HTTP probing toolkit that checks which hosts serve web content and reports status, title, server, TLS and technology data.
11k stars · last push November 10, 2026 · v1.12.0 · MIT
07Screenshots and visual triage
Which of these web apps are worth a closer look?
Archived Go tool that probes common web ports on hosts, screenshots responsive sites with Chromium and clusters them in an HTML report.
6.0k stars · last push May 22, 2022 · v1.7.0 · MIT
- gowitnessActive
Go tool that screenshots websites with headless Chrome from URL lists, CIDRs or Nmap/Nessus results and serves a browsable report.
4.6k stars · last push October 29, 2026 · 3.2.2 · GPL-3.0
08Recon frameworks
Can one tool run the whole workflow?
- BBOTPassive and active modes
Recursive Python scanner with presets for subdomains, emails, cloud assets, web spidering and web scanning, inspired by SpiderFoot.
11k stars · last push November 11, 2026 · v3.0.2 · AGPL-3.0
- FinalReconPassive and active modes
Single Python script for a quick web recon overview: headers, TLS, WHOIS, DNS, subdomains, crawling, directories, Wayback and ports.
3.0k stars · last push October 31, 2026 · MIT
- OsmedeusActive
Go workflow engine that runs security scans defined in YAML, with distributed workers, a web UI and a queryable asset database.
6.6k stars · last push November 6, 2026 · v5.1.2 · MIT
- Recon-ngPassive and active modes
Python framework with a Metasploit-style console for modular web-based OSINT, storing harvested data in a per-workspace database.
6.0k stars · last push October 5, 2026 · GPL-3.0
- reconFTWPassive and active modes
Bash orchestrator that chains dozens of recon tools for subdomains, OSINT, web analysis and optional vulnerability checks.
8.4k stars · last push November 2, 2026 · v4.1 · MIT
- reNginePassive and active modes
Self-hosted web UI that runs YAML-configured recon scan engines and stores results in a database for filtering and reports.
8.9k stars · last push November 8, 2026 · v2.2.0 · GPL-3.0
- sn0intPassive and active modes
Rust OSINT framework and module package manager that runs sandboxed Lua modules and stores entities in a typed database.
2.6k stars · last push September 20, 2026 · v0.26.1 · GPL-3.0
- SpiderFootPassive and active modes
Python OSINT automation tool with 200+ modules, a web UI and CLI, correlating data about domains, IPs, emails, names and more.
24k stars · last push April 13, 2026 · v4.0 · MIT
Other jobs: Scope a pentest · Research a competitor