Reconnaissance & OSINT

Automated OSINT reconnaissance platform with over 200 data sources. Integrates Shodan, VirusTotal and HaveIBeenPwned.

Full-featured web reconnaissance framework designed to gather information from open sources quickly.

Tool for gathering emails, subdomains, IPs and URLs using multiple public data sources.

Network mapping and attack surface discovery tool. Finds subdomains and IPs.

Find usernames across multiple social networks. Ideal for OSINT investigations.

Search engine for Internet-connected devices. Find servers, routers, webcams and more.

Collection of free OSINT tools organized by categories. Essential starting point.

Fast passive subdomain discovery tool. Uses multiple data sources.

Directory/file, DNS and vhost brute-forcing tool written in Go.

Fast web fuzzer written in Go. Ideal for discovering directories and parameters.

Link analysis and data enrichment tool. Visualizes relationships between people, domains and emails.

Certificate Transparency search engine. Find subdomains from issued TLS certificates.

Next-generation web crawler from ProjectDiscovery. Supports JavaScript rendering and finds hidden endpoints.

Fast, multi-purpose DNS toolkit to resolve, filter and enumerate records at scale.

Finds domains and subdomains related to a given domain.

Search platform that continuously scans the Internet to find exposed devices and services.

Visual inspection tool of websites for pentesting. Generates screenshots of hosts.

Ultra-fast web crawler designed for OSINT. Extracts URLs, emails, files and more.

Fast port scanner written in Go. Designed for large-scale scans.

Fast and multipurpose HTTP toolkit. Probes web services and extracts information.