Also strong
Passive subdomain enumeration aggregating many OSINT sources with resolver validation options.
pentestosintdnssubdomains
Browse & filter
Filter by platform, license text, maturity, maintenance cadence, and editorial tags like privacy-focused or self-hosted. Search matches names, summaries, tags, and use cases.
5 tools match your filters
Top pick
Attack surface mapping engine: DNS, certificates, APIs, scraping, and graphing for deep asset discovery.
pentestosintasmowasp
Also strong
E-mail, subdomain, and host harvesting from search engines, PGP servers, and common OSINT APIs.
pentestosintreconemail
Honorable mention
Hunt usernames across public social sites (OSINT).
osintusername
Honorable mention
OSINT automation aggregating hundreds of public data sources.
osintthreat-intel