assetfindergithub.com
Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.
domaindetails
tools / subdomainfinder-c99
C99 Subdomain Finder
Free web-based subdomain finder that returns subdomains with their resolved IPs and Cloudflare status. Previous scans are browsable.
freeweb
similar tools
BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
crt.shcrt.sh
Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.
domaincompanydetails
DNSDumpsterdnsdumpster.com
Free domain research tool from HackerTarget that maps DNS records, subdomains, hosts and mail servers from passive sources and draws a network graph.
domaindetails
OWASP Amassgithub.com
In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.
domainip / asncompanydetails
SecurityTrailssecuritytrails.com
Historical DNS records, subdomains, associated domains and reverse lookups by IP, nameserver or mail server, from a very large passive DNS dataset.
domainip / asndetails