SubMon

SubMon Some say bug bounty isn't just about finding bugs, but being the "first" to find them. I'm building this tool to notify hunters when new subdomains appear. Features You can add your favorite target: name + domain. Then you can either click scan or schedule a scan. When the scan finishes, y...

Monitorizer

Monitorizer The Ultimate Subdomain Monitoring Framework Installation ❗ Disclaimer --- Admin users are able to execute code on the local server make sure to change the default password at otherwise use it at your own risk Using docker root@kitploit: $ curl...

3klCon

3klCon Project Archived Description Automated Recon tool which works with Large and Medium scopes. ّIt's recommended to use it on VPS, it'll discover secrets and search for vulnerabilities So, Welcome, and let's get deep into it subfinder is installed. -- findomain is insta...

domain-protect

OWASP Domain Protect - moved OWASP Domain Protect has moved to terraform-aws-domain-protect OWASP Domain Protect is now available as a Terraform Module See OWASP Domain Protect documentation including options for migration...

nodesub

NODESUB Nodesub is a command-line tool for finding subdomains in bug bounty programs. It supports various subdomain enumeration techniques and provides flexible options for customization. Features Perform subdomain enumeration using CIDR notation Support input list. Perform subdomain enumeration...

hacks

Hacks Hacky one-off scripts, tests etc...

tugarecon

TugaRecon TugaRecon is an advanced reconnaissance and intelligence framework that goes beyond enumeration. It observes, interprets, remembers, and reacts — transforming subdomains into architectural intelligence. 🧭 Philosophy TugaRecon is inspired by Portuguese explorers. During the 15th and 16th...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

unimap

Unimap Scan only once by IP address and reduce scan times with Nmap for large amounts of data. Unimap is an abbreviation of "Unique Nmap Scan ". The tool can run in Linux, OSX, Windows or Android Termux without problems. Why? If you have plans to run a Nmap to a whole organization you need to...

OneForAll

OneForAll 👊OneForAll is a powerful subdomain integration tool 📝中文文档 🚀Start Guide 📢 Please read this document to help you start quickly! 🐍Installation requirements OneForAll is developed and tested based on Python 3.6.0, OneForAll needs to be higher than Python 3.6.0 to run. For more information o...

GETROBARB

GETROBARB XSS Scanner is an automated framework for reconnaissance and detection of XSS Cross-Site Scripting vulnerabilities written in Bash, designed for authorized web security audits. It integrates several popular utilities from the bug bounty and pentesting ecosystem to automate the entire...

FinalRecon

Twitter - Telegram - thewhiteh4t's Blog FinalRecon is an all in one automatic web reconnaissance tool written in python. Goal of FinalRecon is to provide an overview of the target in a short amount of time while maintaining the accuracy of results. Instead of executing several tools one after...

Ashok

Ashok Incredible Fast Recon Swiss Army Knife 📌 Introduction Reconnaissance is the first phase of penetration testing which means gathering information before any real attacks are planned So Ashok is an Incredible fast recon tool for penetration tester which is specially designed for Reconnaissanc...

Turbolist3r

Project Status Please note I am not actively supporting this project. I may return to subdomain research at some point but my security interests lie elsewhere at the moment and my time is divided among other things. If you find an issue feel free to send a PR or fork it into your own project...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

submonitor

submonitor by xpl0ited1 Description Subdomain monitor with reporting capabilities to Slack, Discord and Telegram Usage: Configure the scanning targets on the targets.txt file, set the reporting config at the config.yaml, then create a cronjob to execute every day root@kitploit: crontab -e 0 8...

Striker

Striker Recon & Vulnerability Scanning Suite Important Notice Striker 2.0 is still in prototype phase, which means it's not intended to be used by regular users. It has been made public for contrbutions to make the development faster. Usage: python3 striker.py example.com Workflow Phase 1: Attack...

subdosec

Subdosec Subdomain takeover scanner & reconnaissance tool. Install • Usage • Web Based • Contribution • Online scan • Acknowledgments Subdosec is a fast and accurate subdomain takeover scanner with no false positives, featuring a public database of vulnerable subdomains and detailed non-vulnerabl...

SubGPT

SubGPT looks at subdomains you have already discovered for a domain and uses BingGPT to find more. Best part? It's free! The following subdomains were found by this tool with these 30 subdomains as input. root@kitploit: call-prompts-staging.example.com dclb02-dca1.prod.example.com...

OpenDoor

OpenDoor — OWASP Web Recon & Directory Discovery Platform OpenDoor is an open-source CLI Recon Platform for authorized web reconnaissance, directory discovery, subdomain enumeration, fingerprints, WAF detection, bypass probing, response filtering, reporting, open-redirect checks, bounded crawl an...