BBOTgithub.com
Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.
domainip / asncompanydetails
tools / theharvester
theHarvester
Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.
freeosscli
field note
Ships with Kali. Use "-b all" with API keys configured for the widest coverage. The output helps you infer a company's email format.
similar tools
recon-nggithub.com
Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.
domaincompanyemailip / asndetails
assetfindergithub.com
Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.
domaindetails
crt.shcrt.sh
Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.
domaincompanydetails
OWASP Amassgithub.com
In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.
domainip / asncompanydetails
subfindergithub.com
Fast passive subdomain enumeration CLI that aggregates dozens of sources (CT logs, passive DNS, search engines) without touching the target.
domaindetails