Search

Best OSINT Tools for Attack Surface Mapping

Attack surface mapping (ASM) is reconnaissance from the outside in: enumerating subdomains, discovering exposed hosts and services, fingerprinting technologies, and surfacing leaked credentials or misconfigurations. Red teams, bug-bounty hunters, and defenders use these tools to see what an adversary sees. Here are the 295 attack-surface and recon OSINT tools in the catalogue, indexed by the inputs (domain, IP, ASN) they take and what they reveal.

295tools
Browse with filters
BuiltWith icon

BuiltWith

Website technology profiling platform

FreemiumWebAPI
IN
OUT
Censys icon

Censys

Internet asset and certificate search engine

FreemiumWebAPI
IN
OUT+1
DomainTools icon

DomainTools

Enterprise domain and DNS intelligence

PaidWebAPI
IN
OUT
FOFA icon

FOFA

Internet asset search and mapping engine

FreemiumWebAPI
IN
OUT+1
GreyNoise icon

GreyNoise

Internet scanner reputation intelligence

FreemiumWebAPI
IN
OUT
Masscan icon

Masscan

Very fast internet-scale port scanner

FreeOSSCLI
IN
OUT
Nmap icon

Nmap

Network mapping and port scanning tool

FreeOSSCLI
IN
OUT
OWASP Amass icon

OWASP Amass

Attack-surface mapping and DNS enumeration

FreeOSSCLI
IN
OUT+1
Recon-ng icon

Recon-ng

Modular web reconnaissance framework

FreeOSSCLI
IN+5
OUT+1
SecurityTrails icon

SecurityTrails

DNS history and domain intelligence platform

FreemiumWebAPI
IN
OUT+1
Shodan icon

Shodan

Search exposed internet-connected services

FreemiumWebAPI
IN
OUT+2
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
Wappalyzer icon

Wappalyzer

Detect technologies used by websites

FreemiumWebAPI
IN
OUT
Wireshark icon

Wireshark

Network protocol analyzer

FreeOSSDesktop AppCLI
IN
OUT
ZoomEye icon

ZoomEye

Cyberspace search engine for exposed assets

FreemiumWebAPI
IN
OUT+1
theHarvester icon

theHarvester

Collect emails and subdomains from public sources

FreeOSSCLI
IN
OUT+1
urlscan.io icon

urlscan.io

Scan and analyze URLs safely

FreemiumWebAPI
IN
OUT+2
AADInternals icon

AADInternals

Recon Azure AD / M365 tenant info from a domain

FreeOSSCLI
IN
OUT
AFRINIC Whois icon

AFRINIC Whois

AFRINIC regional WHOIS service

FreeWeb
IN
OUT
ALterX icon

ALterX

Subdomain permutation generator by ProjectDiscovery

FreeOSSCLI
IN
OUT
APKLeaks icon

APKLeaks

Scan an Android APK for hardcoded URLs, endpoints and secrets

FreeOSSCLI
IN
OUT
APNIC Whois icon

APNIC Whois

APNIC regional WHOIS service

FreeWeb
IN
OUT
ARIN Whois-RWS icon

ARIN Whois-RWS

ARIN regional WHOIS API

FreeWebAPI
IN
OUT
ASNLookup icon

ASNLookup

Free ASN to prefix lookup

FreeOSSWebAPI
IN
OUT
ASNmap icon

ASNmap

ASN to CIDR resolver by ProjectDiscovery

FreeOSSCLI
IN
OUT
ASlookup icon

ASlookup

Look up ASN, owner and announced prefixes for an IP

FreeWeb
IN
OUT
Advangle icon

Advangle

Visual advanced-search query builder for Google and Bing

FreeWeb
IN
OUT
Altdns icon

Altdns

a subdomain permutation tool that generates altered hostnames for DNS brute f

FreeOSSCLI
IN
OUT
Analyze ID icon

Analyze ID

Link sites sharing Analytics, AdSense, or tracking IDs

FreeWeb
IN
OUT
Aquatone icon

Aquatone

HTTP host screenshotting and clustering

FreeOSSCLI
IN
OUT
Arjun icon

Arjun

an HTTP parameter discovery tool for finding hidden inputs accepted by web ap

FreeOSSCLI
IN
OUT
Assetfinder icon

Assetfinder

a command-line tool for finding domains and subdomains related to a target or

FreeOSSCLI
IN
OUT
AttackSurfaceMapper icon

AttackSurfaceMapper

Recon CLI chaining LinkedIn, Shodan, screenshots

FreeOSSCLI
IN
OUT
BBOT icon

BBOT

Recursive multi-source recon scanner

FreeOSSCLI
IN
OUT
BGP.tools icon

BGP.tools

Real-time BGP routing visibility platform

FreemiumWebAPI
IN
OUT
BGPView icon

BGPView

Free BGP routing data REST API

FreeWebAPI
IN
OUT
BeVigil icon

BeVigil

Mobile-app security search engine surfacing APK secrets, keys and subdomains

FreemiumWebAPI
IN
OUT+1
BeVigil OSINT CLI icon

BeVigil OSINT CLI

Query BeVigil API for hosts, subdomains and S3 buckets from apps and domains

FreemiumOSSCLIAPI
IN
OUT
BinaryEdge icon

BinaryEdge

Paid internet-scan and asset discovery API

FreemiumWebAPI
IN
OUT
BitSight icon

BitSight

External cyber-risk rating by BitSight

PaidWebAPI
IN
OUT
Blacklist Checker icon

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

FreemiumWebAPI
IN
OUT
BucketLoot icon

BucketLoot

Scan open cloud buckets for exposed files and secrets

FreeOSSCLI
IN
OUT
Burp Suite icon

Burp Suite

a commercial web security testing platform for proxying, scanning, and analyz

FreemiumWeb
IN+1
OUT
CIRCL Passive DNS icon

CIRCL Passive DNS

CIRCL passive DNS service for researchers

FreeOSSAPICLI
IN
OUT
CMSeeK icon

CMSeeK

a CMS detection and exploitation-aid tool for identifying website platforms a

FreeOSSCLI
IN
OUT
CVE Details icon

CVE Details

a searchable vulnerability database for CVEs, vendors, products, versions, an

FreeWeb
IN+1
OUT
Can I Take Over XYZ icon

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

FreeOSSCLI
IN+1
OUT
Carbon Dating the Web icon

Carbon Dating the Web

Estimates the creation date of a web page from a URL

FreeWeb
IN
OUT
CeWL icon

CeWL

Spiders a website to build a custom wordlist from its page text

FreeOSSCLI
IN
OUT
Censys Search Pro icon

Censys Search Pro

Censys attack-surface management platform

PaidWebAPI
IN
OUT
CentralOps icon

CentralOps

Web toolkit for WHOIS, DNS, and IP network lookups

FreemiumWeb
IN
OUT
CertKit CT Log Search icon

CertKit CT Log Search

Search Certificate Transparency logs by domain for subdomains

FreemiumWeb
IN
OUT
Certspotter icon

Certspotter

Certificate Transparency monitoring service

FreemiumOSSCLIWeb
IN
OUT
Chaos icon

Chaos

Curated bug-bounty subdomain dataset

FreemiumOSSWebAPI
IN
OUT
Checkov icon

Checkov

Scan infrastructure-as-code for misconfigurations

FreeOSSCLI
IN
OUT
Cloud Custodian icon

Cloud Custodian

Query cloud accounts for policy-violating resources

FreeOSSCLI
IN
OUT
CloudFail icon

CloudFail

Find the origin IP of a Cloudflare-protected domain

FreeOSSCLI
IN
OUT
Cloudlist icon

Cloudlist

Cloud-provider asset enumerator

FreeOSSCLI
IN
OUT
Columbus Project icon

Columbus Project

Fast subdomain enumeration from CT logs and DNS, API-first

FreeOSSAPIWeb
IN
OUT
CompleteDNS icon

CompleteDNS

Historical nameserver records and reverse-NS lookup

FreemiumWebAPI
IN
OUT
Showing 60 of 295 — browse all

Other investigation types

Person Investigation
500 tools
Company / Organization Investigation
280 tools
Cyber Threat Intelligence
380 tools
Social Media Intelligence (SOCMINT)
322 tools
Geospatial Intelligence (GEOINT)
200 tools
Financial Investigation
120 tools
Fraud Investigation
251 tools