Tool · recon
Amass
Deep passive subdomain enumeration across many public sources.
Use responsibly
Test only systems you own or are explicitly authorized to test. Unauthorized testing is illegal.
Tagsrecon
More tools
- assetfinderreconFast passive subdomain discovery drawing on crt.sh, certspotter, hackertarget, threatcrowd and wayback.
- cdncheckreconClassifies a host as CDN, WAF or cloud and names the provider.
- dnsxreconFast DNS resolution and record enumeration from ProjectDiscovery.
- Fast Google Dorks ScanreconAn automated bash tool that runs a large set of Google dork search queries against a target domain to surface admin panels, widely-exposed file types and locations, and potential path-traversal exposures. Runs directly on Linux/Kali or via Docker, takes only a domain name as input, and supports an optional request proxy.
- github-searchreconCollection of Bash/Python/PHP scripts for reconnaissance against GitHub: credential/secret discovery, user and employee enumeration, dorking, subdomain enumeration, and repository/endpoint extraction. Authored by bug-bounty researcher gwen001.
- GotatorreconSubdomain permutation generator that emits candidate names to resolve, closing the active-permutation gap passive enumeration misses.