A collection of search queries that can reveal sensitive information, vulnerabilities, and exposed data indexed by Google. Free to access through Exploit-DB's Google Hacking Database.
#reconnaissance tools
44 results
Amass by OWASP performs comprehensive attack surface mapping and asset discovery.
Find domains and subdomains related to a given domain
Automate your reconnaissance process with AttackSurfaceMapper, a tool for mapping and analyzing network attack surfaces.
An OSINT tool to search for accounts by username in 581 sites. Features include asynchronous execution, highly customizable, and CSV/TXT export.
Advanced email reconnaissance tool leveraging public data.
A search engine for the Internet of Things (IoT) that provides real-time information about connected devices.
A script to extract subdomains/emails for a given domain using SSL/TLS certificate dataset on Censys.
A multi-threaded Java application designed to brute force directories and filenames on web servers, helping identify hidden content and potential attack vectors. Free and included in Kali L…
Setup script for Regon-ng
A web application and remote desktop screenshot utility that captures screenshots of websites, RDP services, and VNC servers. Free and open-source tool for reconnaissance and reporting.
FingerprintX is a standalone utility for service discovery on open ports.
An offensive Google framework focused on OSINT gathering and vulnerability research around Google services and products. Latest v2.0.1 release includes major improvements.
A reconnaissance tool for GitHub organizations
A tool designed for gathering email account information during penetration tests, allowing users to collect email addresses from different public sources.
Ultimate Internet of Things/Industrial Control Systems reconnaissance tool powered by Shodan.
A subdomain scan tool that helps you find subdomains of a given domain.
An open source network penetration testing framework with automatic recon and scanning capabilities.
An OSINT tool that generates username lists for companies on LinkedIn for social engineering attacks or security testing purposes.
A LinkedIn reconnaissance tool for gathering information about companies and individuals on the platform.
Interactive data mining tool for link analysis
An Open-source intelligence (OSINT) honeypot that monitors reconnaissance attempts by threat actors and generates actionable intelligence for Blue Teamers.
A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
A collection of PowerShell modules for artifact gathering and reconnaissance of Windows-based endpoints.
Load more tools
Showing 24 of 44