#reconnaissance (30 Repositories)
Ranked open-source repositories tagged with #reconnaissance, scored by pull request acceptance likelihood and maintainer engagement velocity.
50.5%
47.1h
30 repositories tagged #reconnaissance
praetorian-inc/nerva
Fast service fingerprinting CLI for 170+ protocols (TCP/UDP/SCTP) - built by Praetorian
laramies/theHarvester
E-mails, subdomains and names Harvester - OSINT
NovaCode37/Prism-platform
Self-hosted OSINT platform. Point it at a domain, IP, email, phone or username and 26 modules run in parallel: WHOIS, DNS, threat intel, breaches, username search. One dashboard, an exposure score, an entity graph, HTML and PDF reports.
projectdiscovery/subfinder
Fast passive subdomain enumeration tool.
praetorian-inc/julius
Simple LLM service identification - translate IP:Port to Ollama, vLLM, LiteLLM, or 60+ other AI services in seconds
sherlock-project/sherlock
Hunt down social media accounts by username across social networks
sharsil/mailcat
Find existing email addresses by nickname using API/SMTP checking methods without user notification. Please, don't hesitate to improve cat's job! 🐱🔎 📬
j3ssie/osmedeus
A Modern Orchestration Engine for Security
edoardottt/csprecon
Discover new target domains using Content Security Policy
leebaird/discover
Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Ubuntu. Limited support for Kali Linux.
003random/getJS
A tool to fastly get all javascript sources/files
edoardottt/favirecon
Use favicons to improve your target recon phase. Quickly detect technologies, WAF, exposed panels, known services.
7onez/cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code. 67+ commands, 35 techniques, no API keys required.
kpcyrd/sn0int
Semi-automatic OSINT framework and package manager
sundowndev/phoneinfoga
Information gathering framework for phone numbers
projectdiscovery/urlfinder
A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.
krishpranav/vesper
A simple username osint tool built in rust
owl234/ARL-Next
现代化资产测绘与漏洞监控平台 (ARL-Next)。经典 ARL 架构重构，聚焦企业资产关联、异步解耦并发调度与原生 MCP 协议集成，容器化开箱部署。
AnonCatalyst/Ominis-OSINT
This Python application is an OSINT (Open Source Intelligence) tool called "Ominis OSINT - Web Hunter." It performs online information gathering by querying Google for search results related to a user-inputted query. The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.
vflame6/leaker
Passive leak enumeration tool.
pikpikcu/airecon
AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is designed to automate security assessments, penetration testing, and bug bounty reconnaissance — without any API keys or cloud dependency.
thewhiteh4t/seeker
Accurately Locate Smartphones using Social Engineering
thewhiteh4t/FinalRecon
All In One Web Recon
olizimmermann/s3dns
Find S3 AWS/GCP/Azure buckets while surfing. S3DNS acts as DNS server, follows CNAMEs and matches any bucket pattern
Jieyab89/OSINT-Cheat-sheet
OSINT cheat sheet, list OSINT tools, wiki, dataset, article, book , red team OSINT for hackers and OSINT tips and OSINT branch. This repository will grow every time will research, there is a research, science and technology, tutorial. Please use it wisely.
yogeshojha/rengine
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
z0m31en7/Uscrapper
Uscrapper Vanta: Dive deeper into the web with this powerful open-source tool. Extract valuable insights with ease and efficiency, from both surface and deep web sources. Empower your data mining and analysis with Vanta's advanced capabilities. Fast, reliable, and user-friendly, Uscrapper Vanta is the ultimate choice for researchers and analysts.
utkusen/shotlooter
a recon tool that finds sensitive data inside the screenshots uploaded to prnt.sc
abhijithb200/investigator
An online handy-recon tool
mhmdiaa/second-order
Second-order subdomain takeover scanner