BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
tools / amass
OWASP Amass
In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.
freeactiveacct optionalosscli
field note
Use passive mode (amass enum -passive) to stay off the target's DNS. Active and brute-force modes resolve names against the target's infrastructure.
opsec warning
This tool is active: it interacts directly with the target's infrastructure or may otherwise reveal your interest to the target. Use a research environment and weigh the risk before running it.
similar tools
bgp.toolsbgp.tools
Modern BGP and ASN explorer with live routing data, upstream/downstream graphs, prefix history and DNS data per network.
ip / asncompanydetails
Censyssearch.censys.io
Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.
ip / asndomaincompanydetails
crt.shcrt.sh
Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.
domaincompanydetails
Hurricane Electric BGP Toolkitbgp.he.net
BGP and ASN explorer covering prefixes announced by an ASN, peers, upstreams, IRR records and organization search across registries.
ip / asncompanydetails
PeeringDBpeeringdb.com
Community database of networks, data centers and internet exchanges. Shows where an ASN physically peers and who operates it.
ip / asncompanylocationdetails