Scope a pentest
What does this organisation expose, before I start testing?
Recon is the first phase of an authorised test. The goal is a complete, deduplicated list of in-scope assets: subdomains, live hosts, open ports, web endpoints and the technology behind them. Start passive, confirm scope, then go active only against what the engagement letter covers.
Before you start
- Have written authorisation that names the domains, IP ranges and dates before any active step.
- Check each discovered asset against the scope list. A subdomain on a third-party host is often out of scope.
- Respect the rate limits in the rules of engagement. Most active tools here default to fast.
01Subdomain discovery
Which hostnames exist under this domain?
- OWASP AmassPassive and active modes
Maps an organization's external attack surface from open sources, with optional zone transfers, certificate grabs and DNS brute force.
15k stars · last push November 11, 2026 · v5.1.3 · Apache-2.0
- subfinderPassive
Finds subdomains of a domain by querying passive online sources such as certificate logs and DNS datasets.
15k stars · last push November 9, 2026 · v2.17.0 · MIT
- theHarvesterPassive and active modes
OSINT collector that gathers hostnames, emails, IPs, URLs, ASNs and breach names for a domain from 66 public sources.
18k stars · last push November 10, 2026 · 4.11.1 · GPL-2.0
02DNS resolution and enumeration
Which of these names resolve, and to what?
- dnsxActive
Fast DNS toolkit that resolves, queries record types, brute forces names and filters wildcard DNS for lists of hosts.
2.9k stars · last push November 9, 2026 · v1.3.1 · MIT
Python DNS reconnaissance tool that tries a zone transfer, guesses subdomains, and scans nearby IPs to find non-contiguous IP space.
1.8k stars · last push August 28, 2024 · GPL-3.0
- MassDNSActive
High-performance DNS stub resolver in C for resolving millions of names, often used for subdomain brute forcing.
3.7k stars · last push September 27, 2026 · v1.1.0 · GPL-3.0
- shuffleDNSActive
Go wrapper around massdns that brute forces or resolves subdomains at high volume and filters wildcard DNS.
1.7k stars · last push November 9, 2026 · v1.2.1 · GPL-3.0
03Internet exposure search
What have internet-wide scanners already recorded about these hosts?
- MetabigorPassive
OSINT CLI that maps IP ranges, certificate subdomains, related domains, archived URLs and CDN use from free sources, no API key needed.
1.9k stars · last push August 8, 2026 · v2.2.0 · MIT
- uncoverPassive
Queries Shodan, Censys, FOFA and other internet search engine APIs at once to list exposed hosts and ports.
3.1k stars · last push November 9, 2026 · v1.2.1 · MIT
04Port scanning
Which network services are listening?
- MASSCANActive
Asynchronous Internet-scale port scanner with nmap-like flags, its own TCP/IP stack and optional banner grabbing on common protocols.
26k stars · last push October 5, 2026 · 1.3.2 · AGPL-3.0
- NaabuPassive and active modes
Go port scanner doing fast SYN, CONNECT and UDP scans across hosts, CIDRs and ASNs, with CDN exclusion and Nmap hand-off.
6.4k stars · last push November 9, 2026 · v2.7.0 · MIT
- NmapActive
Network scanner that discovers live hosts, open ports, service versions and operating systems, with a Lua scripting engine for extra checks.
14k stars · last push November 9, 2026 · LicenseRef-NPSL
05HTTP probing
Which hosts run a web server, and what does it return?
- httpxActive
Multi-purpose HTTP probing toolkit that checks which hosts serve web content and reports status, title, server, TLS and technology data.
11k stars · last push November 10, 2026 · v1.12.0 · MIT
06Technology fingerprinting
What software and versions sit behind a website?
- WhatWebActive
Ruby web fingerprinter with 1800+ plugins that identifies CMSs, frameworks, servers, analytics, JavaScript libraries and versions.
7.0k stars · last push April 2, 2026 · v0.6.4 · GPL-2.0
07Screenshots and visual triage
Which of these web apps are worth a closer look?
Archived Go tool that probes common web ports on hosts, screenshots responsive sites with Chromium and clusters them in an HTML report.
6.0k stars · last push May 22, 2022 · v1.7.0 · MIT
- gowitnessActive
Go tool that screenshots websites with headless Chrome from URL lists, CIDRs or Nmap/Nessus results and serves a browsable report.
4.6k stars · last push October 29, 2026 · 3.2.2 · GPL-3.0
08URL and endpoint discovery
Which pages, parameters and API paths exist?
- cariddiActive
Crawls a list of domains and scans the pages it fetches for endpoints, secrets, API keys, error messages and notable file types.
3.8k stars · last push November 5, 2026 · v1.4.6 · GPL-3.0
- getallurls (gau)Passive
Pulls known historical URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and URLScan.
5.2k stars · last push October 12, 2026 · v2.2.4 · MIT
- getJSActive
Extracts JavaScript source URLs from web pages or piped HTTP responses, as a CLI and as a Go package.
902 stars · last push August 29, 2026 · v2.0.0 · MIT
- HakrawlerActive
Lightweight Go crawler that reads URLs from stdin and prints the links and JavaScript file locations it finds.
5.2k stars · last push August 5, 2026 · 2.1 · GPL-3.0
- KatanaActive
Web crawler that maps URLs and endpoints on a target site, with an optional headless browser mode for JavaScript-heavy apps.
18k stars · last push November 9, 2026 · v1.8.0 · MIT
- URLFinderPassive
Passive URL discovery tool from ProjectDiscovery that gathers a domain's known URLs from public archives and intel sources.
921 stars · last push November 9, 2026 · v0.0.3 · MIT
Minimal stdin/stdout tool that lists URLs the Wayback Machine has recorded for a domain and its subdomains.
4.6k stars · last push May 1, 2024 · v0.1.0 · No licence file
09Recon frameworks
Can one tool run the whole workflow?
- BBOTPassive and active modes
Recursive Python scanner with presets for subdomains, emails, cloud assets, web spidering and web scanning, inspired by SpiderFoot.
11k stars · last push November 11, 2026 · v3.0.2 · AGPL-3.0
- FinalReconPassive and active modes
Single Python script for a quick web recon overview: headers, TLS, WHOIS, DNS, subdomains, crawling, directories, Wayback and ports.
3.0k stars · last push October 31, 2026 · MIT
- OsmedeusActive
Go workflow engine that runs security scans defined in YAML, with distributed workers, a web UI and a queryable asset database.
6.6k stars · last push November 6, 2026 · v5.1.2 · MIT
- Recon-ngPassive and active modes
Python framework with a Metasploit-style console for modular web-based OSINT, storing harvested data in a per-workspace database.
6.0k stars · last push October 5, 2026 · GPL-3.0
- reconFTWPassive and active modes
Bash orchestrator that chains dozens of recon tools for subdomains, OSINT, web analysis and optional vulnerability checks.
8.4k stars · last push November 2, 2026 · v4.1 · MIT
- reNginePassive and active modes
Self-hosted web UI that runs YAML-configured recon scan engines and stores results in a database for filtering and reports.
8.9k stars · last push November 8, 2026 · v2.2.0 · GPL-3.0
- sn0intPassive and active modes
Rust OSINT framework and module package manager that runs sandboxed Lua modules and stores entities in a typed database.
2.6k stars · last push September 20, 2026 · v0.26.1 · GPL-3.0
- SpiderFootPassive and active modes
Python OSINT automation tool with 200+ modules, a web UI and CLI, correlating data about domains, IPs, emails, names and more.
24k stars · last push April 13, 2026 · v4.0 · MIT
Other jobs: Audit your own exposure · Research a competitor