DOCSEARCHbyAlgolia
Submit Docs

Awesome Recon Tools

repository·main·Indexed 41 days ago

https://github.com/nateahess/awesome-recon-tools

A curated collection of reconnaissance and footprinting techniques, tools, and search operators for discovering hosts, domains, infrastructure, and identities. Includes resources for domain and network reconnaissance, personal information and email footprinting, and Google search operators.

Tokens
1.4K
Snippets
1
Records
3
Agent score
2%

What's inside Awesome Recon Tools

  1. Personal Information and Email Footprinting Tools

    main

    Tools for gathering personal information, social media presence, and email-related intelligence.

    Web Applications and Programs

    • Epieos: Identity lookup using email addresses.
    • GHunt: Google-account OSINT framework for email addresses or Gaia IDs.
    • Have I Been Pwned: Checks for email/domain exposure in data breaches.
    • Hunter.io: Finds and verifies email addresses associated with a domain.
    • Maigret: Username OSINT tool checking thousands of sites for profiles.
    • Xquik: X (formerly Twitter) data API for search and follower export.

    Command Line Tools (CLI)

    • Linux / Kali:
      • sherlock: Searches social networks for accounts associated with a username.
      • theHarvester: Collects emails, names, subdomains, IPs, and URLs from public sources.

  2. Domain and Network Reconnaissance Tools

    main

    This collection includes tools for gathering network-related information, mapping attack surfaces, and discovering infrastructure.

    Web Applications and Programs

    • Amass: Attack-surface mapping and asset discovery (passive OSINT, active DNS, certificate transparency, brute force).
    • Censys / Shodan: Internet-wide search engines for discovering hosts, services, and exposed devices.
    • crt.sh: Searches certificate transparency logs for domain/subdomain discovery.
    • DNSDumpster: Maps an organization's external attack surface via DNS.
    • httpx: Fast HTTP probing toolkit to identify live web services.
    • Nmap: Network discovery and security auditing (port scanning, service detection).
    • Nuclei: Template-based vulnerability scanner.
    • Subfinder: Fast passive subdomain discovery.
    • SpiderFoot: Automated OSINT collection and reconnaissance framework.
    • Wappalyzer / BuiltWith: Identifies technology stacks and software used by websites.

    Command Line Tools (CLI)

    • Windows:
      • nslookup: Queries DNS records.
      • tracert: Displays network routes and transit delays.
    • Linux / Kali:
      • dig: Queries DNS servers.
      • dnsrecon: Enumerates DNS records and checks for zone transfers.
      • recon-ng: Modular web-based OSINT framework.
      • whois: Queries WHOIS directory services.

  3. Google Search Operators for Reconnaissance

    main

    Use these Google search operators to find publicly indexed information during reconnaissance.

    | Operator       | Purpose                                                                  |
| -------------- | ------------------------------------------------------------------------ |
| `"phrase"`     | Searches for an exact word or phrase.                                    |
| `allintext:`   | Searches for pages containing all specified terms in the page text.      |
| `allintitle:`  | Searches for pages containing all specified terms in the page title.     |
| `allinurl:`    | Searches for pages containing all specified terms in the URL.            |
| `after:`       | Finds documents updated after a specified date.                          |
| `before:`      | Finds documents updated before a specified date.                          |
| `filetype:`    | Restricts results to a specified file type.                              |
| `inurl:`       | Searches for pages containing a specified term in the URL.               |
| `intitle:`     | Searches for pages containing a specified term in the title.             |
| `inanchor:`    | Searches for pages containing specified anchor text.                     |
| `intext:`      | Searches for pages containing a specified term in the page text.         |
| `site:`        | Restricts results to a specified domain or site.                         |
| `*`            | Acts as a wildcard for one or more unspecified words.                    |
| `\|`           | Acts as a logical OR operator between search terms.                     |
| `-`            | Excludes results containing a specified term.                            |