OWASP Amassgithub.com
In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.
domainip / asncompanydetails
tools / bbot
BBOT
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
freeactiveosscli
field note
Use -f passive (or -rf passive) to limit it to modules that don't contact the target. The default presets are active.
opsec warning
This tool is active: it interacts directly with the target's infrastructure or may otherwise reveal your interest to the target. Use a research environment and weigh the risk before running it.
similar tools
recon-nggithub.com
Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.
domaincompanyemailip / asndetails
theHarvestergithub.com
Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.
domaincompanydetails
assetfindergithub.com
Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.
domaindetails
Censyssearch.censys.io
Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.
ip / asndomaincompanydetails
crt.shcrt.sh
Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.
domaincompanydetails