Information Gathering

OWASP Amass for in-depth subdomain enumeration and attack surface mapping.

Industry-standard network scanner for port discovery, service detection, and OS fingerprinting. Core recon tool for every engagement.

Passive subdomain discovery tool. Fast and reliable for bug bounty recon.

DNS enumeration script for zone transfers, subdomain brute force, and record discovery.

Enumerate Windows/Samba information: users, shares, policies.

Graph-based OSINT and link analysis for mapping people, domains, and infrastructure relationships.

Internet-scale port scanner — extremely fast asynchronous TCP scanning.

Modular recon framework with a Metasploit-like interface for OSINT workflows.

OSINT tool to gather emails, subdomains, hosts, and employee names from public sources.