To know more about our Attack Surface Management platform, check out NVADR.

rustbuster

Files, directories and vhost buster written in Rust.

Mxtoolbox

Bulk Domain/IP lookup tool

Domaintoipconverter

Bulk domain to IP converter

Massdns

A DNS resolver utility for bulk lookups

Googleapps Dig

Online Dig tool by Google

DataSploit (IP Address Modules)

An OSINT Framework to perform various recon techniques

Domain Dossier

Investigate domains and IP addresses

Bgpview

Search ASN, IPv4/IPv6 or resource name

Hurricane Electric BGP Toolkit

Keyword to ASN lookup

Viewdns

Multiple domain/IP tools

Ultratools ipv6Info

Multiple information related to IPv6 address

Whois

Command line utility usually used to find information about registered users/assignees of an Internet resource.

ICANN Whois

Whois service by Internet Corporation for Assigned Names and Numbers (ICANN)

RedHunt Labs Attack Surface Recon API

RedHunt Labs' Recon API offers comprehensive domain intelligence and reconnaissance capabilities. With access to their extensive in-house database of over 6 billion records, including domains, subdomains, third-party SaaS, data leaks, and intelligent correlations, this API empowers you to enhance…

SubFinder

SubFinder is a subdomain discovery tool that discovers valid subdomains for websites. Designed as a passive framework to be useful for bug bounties and safe for penetration testing.

Amass

A subdomain enumeration utility

Sublist3r

Subdomains enumeration tool with multiple sources

Aiodnsbrute

Asynchronous DNS brute force utility

LDNS

A DNS library useful for DNS tool programming

Dns-nsec3-enum

Nmap NSE Script for NSEC3 walking

Nsec3map

A tool to NSEC and NSEC3 walking

Crt.sh

Domain certificate Search

Ct-exposer

A tool to discovers sub-domains by searching Certificate Transparency logs

Certgraph

A tool to crawl the graph of certificate Alternate Names

Appsecco - The art of subdomain enumeration

The supplement material for the book "The art of sub-domain enumeration"

SSLScrape

A scanning tool to scrape hostnames from SSL certificates

Wolframalpha

Computational knowledge engine

Project Sonar

Forward DNS Data

Project Sonar

Reverse DNS Data

GoBuster

Directory/File, DNS and VHost busting tool written in Go

Bluto

Recon, Subdomain Bruting, Zone Transfers

Hunter

Email search for a domain

Skrapp

Browser addon to find emails on Linkedin

Email Extractor

Chrome extension to extract emails from web pages

Convertcsv

Online tool to extract email addresses in text, web pages, data files etc.

linkedin2username

OSINT Tool: Generate username lists for companies on LinkedIn

Office365UserEnum

Enumerate valid usernames from Office 365 using ActiveSync.

Zmap

A fast network scanner designed for Internet-wide network surveys

Masscan

An asynchronously TCP port scanner

ZMapv6

A modified version of Zmap with IPv6 support.

Nmap

A free and open source utility for network discovery. The most popular port scanner.

Mxtoolbox

Online tool to check mail exchanger (MX) records

MicroBurst

PowerShell based Azure security assessment scripts

Lyncsmash

Tools to enumerate and attack self-hosted Lync/Skype for Business

Enumeration-as-a-Service

Script for SaaS offering enumeration through DNS queries

ruler

A tool to abuse Exchange services

Github

Github Advanced Search

Bitbucket

Bitbucket Search using Google

Gitrob

Reconnaissance tool for GitHub organizations

Gitlab

Search Gitlab projects

Publicwww

Source Code Search Engine

builtwith

Web technology information profiler tool. Find out what a website is built with.

CloudScraper

A tool to spider websites for cloud resources (S3 Buckets, Azure Blobs, DigitalOcean Storage Space)

InSp3ctor

AWS S3 Bucket/Object finder

Buckets Grayhatwarfare

Search for Open Amazon s3 Buckets and their contents

Spaces-finder

A tool to hunt for publicly accessible DigitalOcean Spaces

GCPBucketBrute

A Google Storage buckets enumeration script

CloudStorageFinder

Tools to find public data in cloud storage systems

Crunchbase

Information about companies (funding, acquisition, merger etc.) and the people behind them

Companieshouse

United Kingdom's registrar of companies

OverSeas Registries

List of company registries located around the world

Opencorporates

Open database of companies in the world

Project Resonance

RedHunt Labs’s Internet wide surveys to study and understand the security state of the Internet.

Project Sonar

Rapid7’s internet-wide surveys data across different services and protocols

Scans.io

Internet-Wide Scan Data Repository, hosted by the ZMap Team

Portradar

Free and open port scan data by packet.tel

LinkedInt

A LinkedIn scraper for reconnaissance

Glassdoor

Company review and rating search

SocialBlade

Track user statistics for different platforms including YouTube and Twitter

Social-Searcher

Social Media Search Engine

Checkuser

Social existence checker

Dumpmon

A twitter bot which monitors multiple paste sites for password dumps and other sensitive information

Pastebin_scraper

Automated tool to monitor pastebin for interesting information

Scavenger

Paste sites crawler (bot) looking for leaked credentials

Pwnbin

Python based Pastebin crawler for keywords.

PwnedOrNot

Tool to find passwords for compromised accounts

Cachedviews

Cached view of pages on the Internet from multiple sources

Wayback Machine

Internet Archive

Shodan

Search engine for Internet-connected devices

Censys

Another search engine for internet-connected devices

Zoomeye

Cyberspace Search Engine

Website

Discover your Attack Surface, Continuously

Twitter

Facebook