Pentest · Network Reconnaissance Tools

Network Reconnaissance Tools

• robertdavidgraham/masscan on GitHub, opens in a new tab

  25.9Kstars

  TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.

  C·GNU Affero General Public License v3.0·steady·4 months ago

• projectdiscovery/katana on GitHub, opens in a new tab

  17.3Kstars

  Next-generation crawling and spidering framework.

  Go·MIT License·active·4 hours ago

• projectdiscovery/subfinder on GitHub, opens in a new tab

  14.2Kstars

  Fast passive subdomain enumeration tool.

  Go·MIT License·active·5 days ago

• projectdiscovery/naabu on GitHub, opens in a new tab

  6.2Kstars

  Fast port scanner written in Go with focus on reliability.

  Go·MIT License·active·4 days ago

• michenriksen/aquatone on GitHub, opens in a new tab

  6Kstars

  Subdomain discovery tool utilizing various open sources producing a report that can be used as input to other tools.

  Go·MIT License·dormant·4 years agoarchived

• TheRook/subbrute on GitHub, opens in a new tab

  3.5Kstars

  DNS meta-query spider that enumerates DNS records, and subdomains.

  Python·GNU General Public License v3.0·dormant·5 years ago

• darkoperator/dnsrecon on GitHub, opens in a new tab

  3.1Kstars

  DNS enumeration script.

  Python·GNU General Public License v2.0·active·10 hours ago

• m0rtem/CloudFail on GitHub, opens in a new tab

  2.7Kstars

  Unmask server IP addresses hidden behind Cloudflare by searching old database records and detecting misconfigured DNS.

  Python·MIT License·slowing·2 years ago

• evilsocket/xray on GitHub, opens in a new tab

  2.3Kstars

  Network (sub)domain discovery and reconnaissance automation tool.

  Go·GNU General Public License v3.0·slowing·2 years agoarchived

• ShawnDEvans/smbmap on GitHub, opens in a new tab

  2.1Kstars

  Handy SMB enumeration tool.

  Python·GNU General Public License v3.0·steady·7 months ago

• mschwager/fierce on GitHub, opens in a new tab

  1.8Kstars

  Python3 port of the original fierce.pl DNS reconnaissance tool for locating non-contiguous IP space.

  Python·GNU General Public License v3.0·slowing·2 years ago

• gamelinux/passivedns on GitHub, opens in a new tab

  1.7Kstars

  Network sniffer that logs all DNS server replies for use in a passive DNS setup.

  C·slowing·2 years ago

• vesche/scanless on GitHub, opens in a new tab

  1.1Kstars

  Utility for using websites to perform port scans on your behalf so as not to reveal your own IP.

  Python·The Unlicense·dormant·3 years agoarchived

• cyberark/ACLight on GitHub, opens in a new tab

  830stars

  Script for advanced discovery of sensitive Privileged Accounts - includes Shadow Admins.

  PowerShell·BSD 3-Clause "New" or "Revised" License·dormant·7 years ago

• fwaeytens/dnsenum on GitHub, opens in a new tab

  701stars

  Perl script that enumerates DNS information from a domain, attempts zone transfers, performs a brute force dictionary style attack, and then performs reverse look-ups on the results.

  Perl·dormant·7 years ago

• johnnyxmas/ScanCannon on GitHub, opens in a new tab

  478stars

  POSIX-compliant BASH script to quickly enumerate large networks by calling masscan to quickly identify open ports and then nmap to gain details on the systems/services on those ports.

  Shell·Other·active·6 days ago

• netdiscover-scanner/netdiscover on GitHub, opens in a new tab

  393stars

  Network address discovery scanner, based on ARP sweeps, developed mainly for those wireless networks without a DHCP server.

  C·GNU General Public License v3.0·slowing·last year

• chrislee35/passivedns-client on GitHub, opens in a new tab

  202stars

  Library and query tool for querying several passive DNS providers.

  Ruby·MIT License·dormant·5 years ago

• makefu/dnsmap on GitHub, opens in a new tab

  118stars

  Passive DNS network mapper.

  C·dormant·9 years ago