Reconnaissance tools

• crt.sh -> httprobe -> EyeWitness Automated domain screenshotting

• jsendpoints Extract page DOM links

• nuclei Vulnerability scanner

• certSniff Certificate transparency log keyword sniffer

• gobuster Website path brute force

• feroxbuster Fast content discovery tool written in Rust

• CloudBrute Cloud infrastructure brute force

• dnsrecon Enumerate DNS records

• Shodan.io Public facing system knowledge base

• AORT (All in One Recon Tool) Subdomain enumeration

• spoofcheck SPF/DMARC record checker

• AWSBucketDump S3 bucket enumeration

• GitHarvester GitHub credential searcher

• truffleHog GitHub credential scanner

• Dismap Asset discovery/identification

• enum4linux Windows/samba enumeration

• skanuvaty Dangerously fast dns/network/port scanner

• Metabigor OSINT tool without API

• Gitrob GitHub sensitive information scanner

• gowitness Web screenshot utility using Chrome Headless