Recon Open Source Projects

SpiderFoot automates OSINT for threat intelligence and mapping your attack surface.

E-mails, subdomains and names Harvester - OSINT

In-depth attack surface mapping and asset discovery

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

The recursive internet scanner for hackers. 🧡

OneForAll是一款功能强大的子域收集工具

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

Next generation web scanner

HTTP parameter discovery suite.

Official repository vuls Scan: 15000+PoCs; 23 kinds of application password crack; 7000+Web fingerprints; 146 protocols and 90000+ rules Port scanning; Fuzz, HW, awesome BugBounty( ͡° ͜ʖ ͡°)...

Open Source Intelligence gathering tool aimed at reducing the time spent harvesting information from open sources.

Email OSINT & Password breach hunting tool, locally or using premium services. Supports chasing down related email

Simple, fast web crawler designed for easy, quick discovery of endpoints and assets within a web application

⚔️ Web Hacker's Weapons / A collection of cool tools used by Web hackers. Happy hacking , Happy bug-hunting

ARL(Asset Reconnaissance Lighthouse)资产侦察灯塔系统旨在快速侦察与目标关联的互联网资产，构建基础资产信息库。 协助甲方安全团队或者渗透测试人员有效侦察和检索资产，发现存在的薄弱点和攻击面。

Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux and Ubuntu.

OSINT tools can be used for Information gathering, Cybersecurity, Reverse searching, bugbounty, trust and safety, red team oprations and more.

Automation for internal Windows Penetrationtest / AD-Security

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

A collection of custom security tools for quick needs.

A collection of awesome one-liner scripts especially for bug bounty tips.

A script that you can run in the background!

Quickly discover exposed hosts on the internet using multiple search engines.

All In One Web Recon

Open source education content for the researcher community

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

🔎 Most Advanced Open Source Intelligence (OSINT) Framework for scanning IP Address, Emails, Websites, Organizations.

List of Awesome Asset Discovery Resources

Mind-Maps of Several Things

Community-maintained dataset of 700+ websites for finding accounts by username — powers OSINT and digital footprint tools.

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

Generates permutations, alterations and mutations of subdomains and then resolves them

Semi-automatic OSINT framework and package manager

Striker is an offensive information and vulnerability scanner.

Tools & Interesting Things for RedTeam Ops

Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.

面向红队的, 高性能高度自由可拓展的自动化扫描引擎 | A highly controllable and extensionable automated scanning engine for red teams

Hidden parameters discovery suite

Reconnaissance Swiss Army Knife

ASN / RPKI validity / BGP stats / IPv4v6 / Prefix / URL / ASPath / Organization / IP reputation / IP geolocation / IP fingerprinting / Network recon / lookup API server / Web traceroute server

Bug Bounty Roadmaps

a recon tool that allows searching on URLs that are exposed via shortener services

OSINT tools and more but without API key

Asset inventory of over 800 public bug bounty programs.

GooFuzz is a tool to perform fuzzing with an OSINT approach, managing to enumerate directories, files, subdomains or parameters without leaving evidence on the target's server and by means of advanced Google searches (Google Dorking).

Semi-automated, feedback-driven tool to rapidly search through troves of public data on GitHub for sensitive secrets.

BigBountyRecon tool utilises 58 different techniques using various Google dorks and open source tools to expedite the process of initial reconnaissance on the target organisation.

:vulcan_salute: Fast, modern, easy-to-use network scanner

Visualize Erlang/Elixir Nodes On The Command Line

Collection of functions and scripts to debug Erlang in production.

An advanced tool for email reconnaissance

Making Favicon.ico based Recon Great again !

An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration

Maryam: Open-source Intelligence(OSINT) Framework

A collection of special paths linked to common sensitive APIs, devops internals, frameworks conf, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

HostHunter a recon tool for discovering hostnames using OSINT techniques.

Automation for javascript recon in bug bounty.