Inventus

Inventus Inventus is a spider designed to find subdomains of a specific domain by crawling it and any subdomains it discovers. It's a Scrapy spider, meaning it's easily modified and extendable to your needs. Demo asciicast Requirements Linux -- I haven't tested this on Windows. Python 2.7 or Pyth...

dnsgen

DNSGen 2.0 - Advanced DNS Name Permutation Engine 🚀 DNSGen is a powerful and flexible DNS name permutation tool designed for security researchers and penetration testers. It generates intelligent domain name variations to assist in subdomain discovery and security assessments. ✨ Features 🔍 Smart...

BlackDir-Framework

BlackDir-Framework 1 Spider Directories 2 Find Sub Domain 3 Advanced Dorks Search 4 Scan list of Dorks 5 Scan WebSites Xss,Sql,Html Inj 6 Reverse Ip Lookup 7 Port Scan 8 Brute Force Wordpress 9 Wordpress User Enumerate 10 Hash Encryptionmd4,md5,sha1,sha256,sha384,sha512 11 Hash Identifier Install...

Findomain

Findomain The complete solution for domain recognition. Supports screenshotting, port scanning, importing data from other tools, subdomain monitoring, and more. Be alerted on your findings through services such as Discord, Slack, and Telegram. Multiple API Keys for sources and much more. Chat wit...

subdomain3

Subdomain3 README.md inChinese 中文 Description Subdomain3 is a new generation of tool , It helps penetration testers to discover more information in a shorter time than other tools.The information includes subdomains, IP, CDN, and so on. Please enjoy it. Screenshot medium pattern for speed Feature...

chomp-scan

Chomp Scan A scripted pipeline of tools to simplify the bug bounty/penetration test reconnaissance phase, so you can focus on chomping bugs. If you've found any bugs using this tool, please let me know! Scope Chomp Scan is a Bash script that chains together the fastest and most effective tools in...

alterx

AlterX Features • Installation • Usage • Running AlterX • Join Discord Fast and customizable subdomain wordlist generator using DSL. Features Fast and Customizable Automatic word enrichment Pre-defined variables Configurable Patterns Pattern Mining - Automatically discover subdomain patterns Go...

PathFinder

Web Path Finder Web Path Finder is a Python program that provides information about a website. It retrieves various details such as page title, last updated date, DNS information, subdomains, firewall names, technologies used, certificate information, and more. Features and Benefits Retrieve...

OneForAll

OneForAll 👊OneForAll is a powerful subdomain integration tool 📝中文文档 🚀Start Guide 📢 Please read this document to help you start quickly! 🐍Installation requirements OneForAll is developed and tested based on Python 3.6.0, OneForAll needs to be higher than Python 3.6.0 to run. For more information o...

ReconDog

ReconDog Reconnaissance Swiss Army Knife Main Features Wizard + CLA interface Can extracts targets from STDIN piped input and act upon them All the information is extracted with APIs, no direct contact is made to the target Utilities Censys: Uses censys.io to gather massive amount of information...

gobuster

Gobuster 💻 Introduction A fast and flexible brute-forcing tool written in Go Gobuster is a high-performance directory/file, DNS and virtual host brute-forcing tool written in Go. It's designed to be fast, reliable, and easy to use for security professionals and penetration testers. ✨ Features 🚀...

zenbuster

About ZenBuster is a multi-threaded, multi-platform URL enumeration tool written in Python by Zach Griffin @0xTas. I wrote this tool as a way to deepen my familiarity with Python, and to help increase my understanding of Cybersecurity tooling in general. ZenBuster may not be the fastest or most...

X-Recon

A utility for identifying web page inputs and conducting XSS scanning. Features: Subdomain Discovery: Retrieves relevant subdomains for the target website and consolidates them into a whitelist. These subdomains can be utilized during the scraping process. Site-wide Link Discovery: Collects all...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and is optimized...

Nuke.sh

NUKE - Recon & Attack Surface Mapper | \ | | | | | |/ / | | | | | | | ' /| | | |\ | || | . | | || |/||\| N U K E // recon & attack surface mapper ----------------------------------------- Bash-based passive reconnaissance + attack surface mapping script using only public APIs + stock Linux...

Turbolist3r

Project Status Please note I am not actively supporting this project. I may return to subdomain research at some point but my security interests lie elsewhere at the moment and my time is divided among other things. If you find an issue feel free to send a PR or fork it into your own project...

react2shell

React2Shell Go Version React2Shell is a high-performance vulnerability scanner written in Go, specifically designed to detect Server-Side Remote Code Execution RCE vulnerabilities in Next.js applications CVE-2025-55182 & CVE-2025-66478. This tool improves upon existing proof-of-concept scripts by...

Striker

Striker Recon & Vulnerability Scanning Suite Important Notice Striker 2.0 is still in prototype phase, which means it's not intended to be used by regular users. It has been made public for contrbutions to make the development faster. Usage: python3 striker.py example.com Workflow Phase 1: Attack...

dnsbrute

dnsbrute Multi-theaded DNS bruteforcing, average speed 80 lookups/second with 40 threads Usage: dnsbrute.py threads...

instarecon

InstaRecon Automated basic digital reconnaissance. Great for getting an initial footprint of your targets and discovering additional subdomains. InstaRecon will do: DNS lookups A, PTR, MX, NS DNS lookups recursively on all hosts discovered Whois on domain and IP lookups Google dorks looking for...