OSINT & Reconnaissance
Tools and services for gathering information from public sources: internet-wide search engines, attack-surface discovery, and domain and certificate intelligence. Mostly passive; active scanning tools live in Offensive Security & Pentesting.
Nmap
Open-source network scanner for host discovery, port and service mapping, and OS detection, with NSE scripting and companion tools in the suite.
Sherlock
Sherlock is a free OSINT tool used to find social media accounts matching a username across many sites for investigators doing lawful research.
OSINT & ReconnaissanceFreeOpen source
wafw00f
wafw00f is a free WAF fingerprinting tool used to detect which web application firewall sits in front of a site for recon and AppSec testers.
WhatWeb
WhatWeb is a free web scanner used to identify technologies, frameworks, and plugins on websites for recon and application security practitioners.
OSINT & ReconnaissanceFreeOpen source
Recon-ng
Recon-ng is a free modular OSINT framework used to gather web-based open source intelligence on people and hosts for investigators and recon teams.
OSINT & ReconnaissanceFreeOpen source
Masscan
Masscan is a free high-speed port scanner used to scan the internet or large address ranges for open TCP ports for pentesters on authorized targets.
dnsx (ProjectDiscovery)
dnsx by ProjectDiscovery is a free DNS toolkit used to resolve, probe, and filter large lists of hostnames for pentesters and recon teams on authorized targets.
OSINT & ReconnaissanceFreeOpen source
Naabu (ProjectDiscovery)
Naabu by ProjectDiscovery is a free port scanner used to quickly find open TCP and UDP ports on many hosts for pentesters and recon teams on authorized targets.
Katana (ProjectDiscovery)
Katana by ProjectDiscovery is a free web crawler used to map URLs, endpoints, and JavaScript files on sites for recon teams and authorized bug bounty hunters.
OSINT & ReconnaissanceFreeOpen source
httpx (ProjectDiscovery)
httpx by ProjectDiscovery is a free HTTP probing toolkit used to check which hosts run live web servers and fingerprint them for recon and bug bounty teams.
OSINT & ReconnaissanceFreeOpen source
urlscan.io
urlscan.io is a freemium web sandbox used to scan suspicious URLs and record what a page loads, contacts, and shows for threat analysts and SOC teams.
Threat IntelligenceFreemium
subfinder
subfinder is a free passive subdomain discovery tool used to enumerate valid subdomains from online sources for bug bounty hunters and recon teams.
OSINT & ReconnaissanceFreeOpen source
theHarvester
theHarvester is a free open-source OSINT tool that gathers emails, subdomains, hosts and related public data about a domain from many online sources.
OSINT & ReconnaissanceFreeOpen source
Maltego
Maltego is an OSINT and investigations platform for visual link analysis, with a free Basic Community Edition and paid Entry and Professional plans.
OSINT & ReconnaissanceFreemium
Censys
Censys maps internet-facing hosts, certificates and services for attack-surface and threat investigations, with a free tier plus credit and enterprise plans.
OSINT & ReconnaissanceFreemium
Amass
OWASP Amass maps external attack surface by discovering domains, addresses and related assets through open-source intelligence and active techniques.
OSINT & ReconnaissanceFreeOpen source
VirusTotal
Online multi-engine scanner for analyzing files, URLs, domains and IPs for malware signals, with free public and paid tiers.
Shodan
Commercial search engine for internet-connected devices and services, used to research exposure and monitor an organization’s attack surface.
OSINT & ReconnaissanceFreemium