Map a domain's public technical footprint with provenance, confidence, and explicit uncertainty. Passive by default, machine-readable, and built to report evidence, not guesses.
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for and bug bounty hunters and security researchers.
Python3 implementation of ADRecon with support for NTLM and Kerberos authentication querying LDAP. Generates individual CSV files and a single XSLX + HTML report about your AD domain.
An implementation of PyADRecon using ADWS instead of LDAP. Generates individual CSV files and a single XSLX + HTML report about your AD domain. Evades EDR detections through ADWS.
Recon tool for pentesters & bug bounty hunters: check robots.txt, security.txt (RFC 9116) and /.well-known/ across many targets. CLI + web UI, single static Go binary.
Advanced subdomain enumeration for Linux & macOS — one Go binary that orchestrates subfinder, dnsx, httpx, asnmap & more into a fast discover→resolve→probe pipeline.
Fast, concurrent username OSINT tool in Go — checks presence across sites via HTTP, JSON, headless browser, and OpenGraph parsing, with SQLite caching and YAML-driven site configs.
A powerful Golang tool to fetch and export FOFA.info search results via API with real-time saving, concurrent requests, and multiple output formats (CSV, JSON, TXT)
Unified reconnaissance CLI for subdomain discovery, HTTP probing, asset discovery, OSINT, and Wayback data combining subfinder, httpx, chaos, uncover, and Wayback CDX in one tool
Canonical Certificate Transparency (crt.sh) client and name-extraction parser for Santh scanners - single source of truth for CT-log subdomain/origin discovery.