Tools

Comprehensive DNS enumeration and network mapping

Fast passive subdomain discovery

Internet-connected device search engine

Internet-wide scanning and certificate transparency

Email, subdomain, and host OSINT gathering

Full-featured reconnaissance framework

DNS enumeration and zone transfer testing

Domain scanner and subdomain brute forcer

Multi-cloud asset enumeration for AWS, Azure, and GCP

Multi-cloud security auditing and misconfiguration detection

AWS exploitation framework for penetration testing

Probe a list of hosts for live HTTP services and fingerprint what they are

Collect TLS certificate data at scale — issuers, SANs, expiry, and misconfiguration

Fast DNS resolution, record lookup, and wildcard-aware brute forcing

Fast SYN/CONNECT port scanning built for pipelines

Map an organization to the IP ranges it actually owns via ASN lookup

Crawl web applications to map endpoints, parameters, and JavaScript-referenced routes

Pull historically-known URLs for a domain from public archives

High-speed fuzzing for content discovery, parameters, and virtual hosts

Template-driven scanning for known vulnerabilities, exposures, and misconfigurations

Find leaked credentials in repositories, filesystems, and cloud storage — and verify whether they still work

Detect hardcoded secrets in git history and block new ones in CI

Recursive OSINT and attack-surface framework that chains many modules automatically

Query Shodan, Censys, FOFA, and other engines from one command line

Pipe tool output to Slack, Discord, Telegram, or a webhook

List assets across cloud providers using read-only credentials