Tool · reconpassive
assetfinder
Fast passive subdomain discovery drawing on crt.sh, certspotter, hackertarget, threatcrowd and wayback.
Use responsibly
Test only systems you own or are explicitly authorized to test. Unauthorized testing is illegal.
Tagsrecon
More tools
- AmassreconDeep passive subdomain enumeration across many public sources.
- cdncheckreconClassifies a host as CDN, WAF or cloud and names the provider.
- dnsxreconFast DNS resolution and record enumeration from ProjectDiscovery.
- Fast Google Dorks ScanreconAn automated bash tool that runs a large set of Google dork search queries against a target domain to surface admin panels, widely-exposed file types and locations, and potential path-traversal exposures. Runs directly on Linux/Kali or via Docker, takes only a domain name as input, and supports an optional request proxy.
- github-searchreconCollection of Bash/Python/PHP scripts for reconnaissance against GitHub: credential/secret discovery, user and employee enumeration, dorking, subdomain enumeration, and repository/endpoint extraction. Authored by bug-bounty researcher gwen001.
- GotatorreconSubdomain permutation generator that emits candidate names to resolve, closing the active-permutation gap passive enumeration misses.