BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
tools / crt-sh
crt.sh
Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.
freeossapiweb
field note
Search %.example.com to wildcard-match subdomains, and append &output=json for scripting. Searching an organization name finds certs for domains you didn't know they owned.
used in playbooks
similar tools
OWASP Amassgithub.com
In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.
domainip / asncompanydetails
theHarvestergithub.com
Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.
domaincompanydetails
assetfindergithub.com
Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.
domaindetails
C99 Subdomain Findersubdomainfinder.c99.nl
Free web-based subdomain finder that returns subdomains with their resolved IPs and Cloudflare status. Previous scans are browsable.
domaindetails
Censyssearch.censys.io
Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.
ip / asndomaincompanydetails