BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
tools / recon-ng
recon-ng
Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.
freeactiveosscli
opsec warning
This tool is active: it interacts directly with the target's infrastructure or may otherwise reveal your interest to the target. Use a research environment and weigh the risk before running it.
similar tools
Maltegomaltego.com
Graph-based link-analysis platform. Run "transforms" against entities (people, domains, emails, companies) to pull data from dozens of integrated sources.
real nameemaildomaincompanyusernameip / asncryptodetails
SpiderFootgithub.com
OSINT automation framework with 200+ modules. Give it a domain, IP, email, name or username and it recursively correlates findings in a web UI.
domainip / asnemailreal nameusernamephonecryptodetails
theHarvestergithub.com
Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.
domaincompanydetails
Censyssearch.censys.io
Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.
ip / asndomaincompanydetails
OWASP Amassgithub.com
In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.
domainip / asncompanydetails